CyberRota Analysis
AI-GeneratedConcrete CMS versions 9.0.0 to 9.5.2 are vulnerable to stored cross-site scripting due to improper sanitization of group folder names, allowing authenticated users with the Add Group Folder permission to inject malicious scripts. This vulnerability can lead to session and token theft, potentially compromising the actions of any administrator who views the affected Groups dashboard. Organizations using these versions should prioritize remediation to protect against potential exploitation by malicious insiders or compromised accounts.
Original NVD Description
Concrete CMS 9.0.0 to 9.5.2 stored group folder names without sanitization and printed them unescaped on the Members > Groups dashboard page, resulting in stored cross-site scripting. The add and edit group-folder handlers stored the submitted folder name without neutralizing HTML, and the group search grid returned it without output encoding, so the Groups dashboard rendered the name as live markup. An authenticated user holding the Add Group Folder permission could store a script payload as a folder name that executed in the session of any administrator who viewed the Groups dashboard, enabling session and token theft and any action available in the administrator's context. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Lý Chấn Hưng (hunglyvn) for reporting.