Low severity2.4NVD Advisory· Published Feb 9, 2024· Updated Jun 17, 2026
CVE-2024-1245
CVE-2024-1245
Description
Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS in file tags and description attributes since administrator entered file attributes are not sufficiently sanitized in the Edit Attributes page. A rogue administrator could put malicious code into the file tags or description attributes and, when another administrator opens the same file for editing, the malicious code could execute. The Concrete CMS Security team scored this 2.4 with CVSS v3 vector AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
concrete5/concrete5Packagist | >= 9.0.0RC1, < 9.2.5 | 9.2.5 |
Affected products
3- Range: 9.0.0
Patches
Vulnerability mechanics
References
5- documentation.concretecms.org/9-x/developers/introduction/version-history/925-release-notesnvdRelease NotesVendor AdvisoryWEB
- github.com/advisories/GHSA-mgp6-j658-vcw9ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-1245ghsaADVISORY
- www.concretecms.org/about/project-news/security/2024-02-04-security-advisorynvdVendor AdvisoryWEB
- github.com/concretecms/concretecms/commit/59a07472ad6349a2c5fb455837a54ed1fe3f6953ghsaWEB
News mentions
0No linked articles in our index yet.