Concrete CMS Stored Cross-Site Scripting Vulnerability in External Link Page

A stored cross-site scripting vulnerability has been identified in Concrete CMS versions through 9.5.0. The issue arises in the external-link page 'cvName', where the 'updateCollectionAliasExternal' function fails to properly sanitize input, allowing for the injection of malicious scripts. This vulnerability can be exploited by a user with editor privileges, potentially leading to session hijacking or other malicious actions.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected page.

Remediation

Users can upgrade to Concrete CMS version 9.5.1 or later to address this vulnerability.