Concrete CMS Stored Cross-Site Scripting Vulnerability in Members Dashboard

A stored cross-site scripting vulnerability has been identified in Concrete CMS versions 9.0.0 through 9.4.2. This issue arises on the Members Dashboard page, where a malicious admin could create a harmful folder containing XSS payloads. Users would be directed to this folder upon login, leading to the execution of the embedded scripts. Notably, version 8 of Concrete CMS is not affected by this vulnerability.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user accessing the Members Dashboard.

Remediation

Users can upgrade to Concrete CMS version 9.4.3, which addresses this vulnerability. Instructions for downloading this version are available on the Concrete CMS website.