Multiple vulnerabilities in Concrete CMS



Published: 2021-03-18
Risk Low
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2021-28145
CVE-2021-3111
CWE-ID CWE-79
Exploitation vector Network
Public exploit Public exploit code for vulnerability #2 is available.
Vulnerable software
Subscribe 		concrete5
Web applications / CMS

Vendor PortlandLabs

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Stored cross-site scripting

EUVDB-ID: #VU51576

Risk: Low

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28145

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in Surveys functionality. A remote user with Editor privileges can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

concrete5: 8.5.0 - 8.5.4

External links

http://documentation.concrete5.org/developers/introduction/version-history/855-release-notes
http://www.concrete5.org/developers/security


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Cross-site scripting

EUVDB-ID: #VU51577

Risk: Low

CVSSv3.1: 4.9 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2021-3111

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: Yes

Description

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in express entries in index.php/dashboard/express/entries/view/ URI. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install update from vendor's website.

Vulnerable software versions

concrete5: 8.5.4

External links

http://packetstormsecurity.com/files/161600/Concrete5-8.5.4-Cross-Site-Scripting.html
http://documentation.concrete5.org/developers/introduction/version-history
http://documentation.concrete5.org/developers/introduction/version-history/855-release-notes
http://github.com/Quadron-Research-Lab/CVE/blob/main/CVE-2021-3111.pdf


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.



###SIDEBAR###