TI-2024-04055 Aliases CVE-2024-4353 GHSA-3cpf-jmmc-8jm3

Stored XSS in Generate Board Name Input Field

LOW 23CWE-20Published 2024-08-01 · Updated 2025-01-17

Key facts

Attack vector: Network
Privileges required: High
User interaction: Active
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Concrete CMS versions 9.0.0 through 9.3.2 are affected by a stored XSS vulnerability in the generate dashboard board instance functionality. The Name input field does not check the input sufficiently letting a rogue administrator have the capability to inject malicious JavaScript code. The Concrete CMS security team gave this vulnerability a CVSS v4 score of 4.6 with a vector of CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Concrete versions below 9 are not affected by this vulnerability.Thanks fhAnso for reporting. (CNA updated this risk rank on 17 Jan 2025 by lowering the AC based on CVSS 4.0 documentation that access privileges should not be considered for AC).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00302 23rd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	concrete5/concrete5 (Packagist)	9.0.0 – 9.3.2	—	No fix listed	GHSA-3cpf-jmmc-8jm3

concrete5/concrete5 (Packagist) Vendor— Affected 9.0.0 – 9.3.2 Fixed in — No fix listed GHSA-3cpf-jmmc-8jm3

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:concretecms:concrete_cms::::::::	9.0.0 to before 9.3.3	Vulnerable	Concrete CMS

cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:* Versions 9.0.0 to before 9.3.3 Vulnerable ·Concrete CMS

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2024-4353
2026-10-03 Alias added: GHSA-3cpf-jmmc-8jm3

References

Patch 1

https://github.com/concretecms/concretecms/pull/12151

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-4353

Other 3

TI-2026-23602 ConcreteCMS v9.4.7 contains a Denial of Service (DoS) vulnerability in the File Manager… CVSS 3.1MEDIUM 6.5
TI-2023-23992 A Cross Site Scripting (XSS) vulnerability in Concrete CMS from versions 9.2.0 to 9.2.2… CVSS 3.1MEDIUM 5.4
TI-2023-26495 Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because… CVSS 3.1CRITICAL 9.8
TI-2026-14907 Missing authorization in Concrete CMS CVSS 4.0HIGH 8.7
TI-2022-06200 Cleartext transmission of sensitive information in https://github.com/concrete5/concrete5 CVSS 3.1CRITICAL 9.8
TI-2021-17294 An issue was discovered in Concrete CMS through 8.5.5. CVSS 3.1CRITICAL 9.8

See all 197 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences