Concrete CMS 9.0.0 to 9.5.2 stored group folder names without sanitization and printed them unescaped on the Members > Groups dashboard page, resulting in stored cross-site scripting. The add and edit group-folder handlers stored the submitted folder name without neutralizing HTML, and the group search grid returned it without output encoding, so the Groups dashboard rendered the name as live markup. An authenticated user holding the Add Group Folder permission could store a script payload as a folder name that executed in the session of any administrator who viewed the Groups dashboard, enabling session and token theft and any action available in the administrator's context. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Lý Chấn Hưng (hunglyvn) for reporting.
| Métrique | Valeur | Interprétation |
|---|---|---|
|
AV (Vecteur d'Attaque)
Attack Vector
|
Network (N)
|
Exploit possible à distance via réseau (HTTP, API, etc.) |
|
AC (Complexité d'Attaque)
Attack Complexity
|
Low (L)
|
Peu de conditions requises pour exploiter |
|
PR (Privilèges Requis)
Privileges Required
|
High (H)
|
Authentifié avec privilèges administratifs |
|
UI (Interaction Utilisateur)
User Interaction
|
Unknown (P)
|
Interaction inconnue |
|
S (Périmètre)
Scope
|
Unchanged (U)
|
Impact reste dans le périmètre du composant compromis |
|
C (Impact Confidentialité)
Confidentiality Impact
|
High (H)
|
Divulgation totale d'informations |
|
I (Impact Intégrité)
Integrity Impact
|
High (H)
|
Modification totale des données possible |
|
A (Impact Disponibilité)
Availability Impact
|
High (H)
|
Interruption totale du service possible |
Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS via group folder name on the Members > Groups dashboard