Moderate severityNVD Advisory· Published Mar 18, 2021· Updated Aug 3, 2024
CVE-2021-28145
CVE-2021-28145
Description
Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct XSS attacks via a crafted survey block. This requires at least Editor privileges.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
concrete5/concrete5Packagist | < 8.5.5 | 8.5.5 |
Affected products
2- Concrete CMS/Concrete CMSdescription
Patches
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- github.com/advisories/GHSA-7388-7vq2-m4f4ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2021-28145ghsaADVISORY
- documentation.concrete5.org/developers/introduction/version-history/855-release-notesghsax_refsource_CONFIRMWEB
- www.concrete5.org/developers/securityghsax_refsource_MISCWEB
News mentions
0No linked articles in our index yet.