{
  "id": "CVE-2024-3180",
  "sourceIdentifier": "ff5b8ace-8b95-4078-9743-eac1ca5451de",
  "published": "2024-04-03T19:15:44.560",
  "lastModified": "2024-08-08T17:15:19.223",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Concrete CMS version 9 below 9.2.8 and previous versions below 8.5.16 is vulnerable to Stored XSS in blocks of type file.\u00a0Stored XSS could be caused by a rogue administrator adding malicious code to the link-text field when creating a block of type file.\u00a0The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 3.1 with a vector of  AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator .\u00a0Thanks Alexey Solovyev for reporting."
    },
    {
      "lang": "es",
      "value": "La versi\u00f3n 9 de Concrete CMS inferior a 9.2.8 y las versiones anteriores inferiores a 8.5.16 son vulnerables a XSS almacenado en bloques de tipo archivo. Antes de la soluci\u00f3n, el XSS almacenado podr\u00eda deberse a que un administrador deshonesto agregaba c\u00f3digo malicioso al campo de texto del enlace al crear un bloque de tipo archivo. El equipo de seguridad de Concrete CMS le dio a esta vulnerabilidad una puntuaci\u00f3n CVSS v3.1 de 3.1 con un vector de AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A: L https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator. Gracias Alexey Solovyev por informar."
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "ff5b8ace-8b95-4078-9743-eac1ca5451de",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "HIGH",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW",
          "baseScore": 3.1,
          "baseSeverity": "LOW"
        },
        "exploitabilityScore": 0.5,
        "impactScore": 2.5
      }
    ]
  },
  "weaknesses": [
    {
      "source": "ff5b8ace-8b95-4078-9743-eac1ca5451de",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://documentation.concretecms.org/9-x/developers/introduction/version-history/928-release-notes?_gl=1*1bcxp5s*_ga*MTc1NDc0Njk2Mi4xNzA2ODI4MDU1*_ga_HFB3HPNNLS*MTcxMjE2NjYyNi4xMy4xLjE3MTIxNjY2ODEuMC4wLjA.",
      "source": "ff5b8ace-8b95-4078-9743-eac1ca5451de"
    },
    {
      "url": "https://documentation.concretecms.org/developers/introduction/version-history/8516-release-notes?_gl=1*1oa3zn1*_ga*MTc1NDc0Njk2Mi4xNzA2ODI4MDU1*_ga_HFB3HPNNLS*MTcxMjE2NjYyNi4xMy4xLjE3MTIxNjY3MDcuMC4wLjA.",
      "source": "ff5b8ace-8b95-4078-9743-eac1ca5451de"
    }
  ]
}