Concrete CMS Reflected Cross-Site Scripting Vulnerability in Conversation Messages Dashboard Page

A reflected cross-site scripting vulnerability has been identified in Concrete CMS versions 9.0.0 through 9.4.2 and versions prior to 8.5.21. The issue occurs on the Conversation Messages Dashboard Page, where unsanitized input could be exploited to steal session cookies or tokens, deface web content, redirect users to malicious sites, and, if the victim is an admin, execute unauthorized actions.

Impact

Exploitation of this vulnerability could lead to reflected cross-site scripting, allowing attackers to inject malicious scripts that could be executed in the context of the user's browser.

Remediation

Users can upgrade to Concrete CMS versions 9.4.3 or 8.5.21, both of which include the necessary patch. Instructions for downloading Concrete CMS are available on the official website.