sromanhu/CVE-2023-44763_ConcreteCMS-Arbitrary-file-upload-Thumbnail

sromanhu/CVE-2023-44763_ConcreteCMS-Arbitrary-file-upload-Thumbnail

GitHubGitHub
GitHubgithub.com
Releases0
ConcreteCMS v.9.2.1 is affected by Arbitrary File Upload vulnerability that allows Cross-Site Scriting (XSS) Stored.
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2023-44763↗
5.4 MEDIUM—

Concrete CMS v9.2.1 is affected by an Arbitrary File Upload vulnerability via a Thumbnail file upload, which allows Cross-Site Scripting (XSS). NOTE: the vendor's position is that a customer is supposed to know that "pdf" should be excluded from the allowed file types, even though pdf is one of the allowed file types in the default configuration.