Cross-site Scripting (XSS)

2019-06-1810:33:01

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

48.7%

JSON

concrete5/concrete5 is vulnerable to cross-site scripting attacks. The library does not sanitize imported SVG files, allowing a malicious user to inject and execute arbitrary web script into a victim’s browser.

CPENameOperatorVersion
concrete5/concrete5le8.4.5

CPE	Name	Operator	Version
	concrete5/concrete5	le	8.4.5

References

github.com/concrete5/concrete5/pull/7291

hackerone.com/concrete5?view_policy=true

hackerone.com/reports/437863

www.concrete5.org/

www.w3.org/TR/SVG2/intro.html#W3CCompatibility

0.001 Low

EPSS

Percentile

48.7%

JSON

Related for VERACODE:20561