CyberRota Analysis
AI-GeneratedConcrete CMS versions 9.5.2 and earlier are susceptible to stored DOM-based Cross-site Scripting (XSS) through the Gallery block's Caption field, allowing an attacker with page editing permissions to inject malicious scripts. This vulnerability can lead to the execution of arbitrary code in the browsers of users viewing the affected images, posing a significant security risk. Organizations using Concrete CMS should prioritize patching this vulnerability to protect their users from potential exploitation.
Original NVD Description
Concrete CMS 9.5.2 and below is vulnerable to stored DOM-based Cross-site Scripting (XSS) via the Gallery block's per-image Caption field because the bundled Magnific Popup lightbox script (concrete/js/features/imagery/frontend.js) re-parses the attribute-decoded caption as HTML through jQuery's .append() in titleSrc instead of inserting it as text. A user with permission to edit a page containing a Gallery block can store a caption that executes in the browser of any visitor who opens that image's lightbox. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 8.5 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.