CVE-2023-44760

Summary

CVE	CVE-2023-44760
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2023-10-23 22:15:00 UTC
Updated	2023-11-15 22:15:00 UTC
Description	Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS v.9.2.1 allow an attacker to execute arbitrary code via a crafted script to the Header and Footer Tracking Codes of the SEO & Statistics.

Risk And Classification

Problem Types: CWE-79

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Concretecms	Concrete Cms	9.2.1	All	All	All

References

Reference	Source	Link	Tags
GitHub - sromanhu/CVE-2023-44760_ConcreteCMS-Stored-XSS---TrackingCodes: Multiple Cross Site Scripting vulnerability in ConcreteCMS v.9.2.1 allows a local attacker to execute arbitrary code via a crafted script to the Header and Footer Tracking Codes of the SEO & Statistics	MISC	github.com
github.com/sromanhu/CVE-2023-44760_ConcreteCMS-Stored-XSS---TrackingCode...		github.com
www.concretecms.org/about/project-news/security/security-advisory-2023-10-31-conc...		www.concretecms.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

995692 PHP (Composer) Security Update for concrete5/concrete5 (GHSA-4qv6-37xq-mgq2)