Cross Site Scripting (XSS)

2024-02-1207:19:12

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross site scripting

concrete5

role name

roles_list.php

admin privileges

stored

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

AI Score

6.3

Confidence

High

EPSS

Percentile

14.0%

JSON

concrete5/concrete5 is vulnerable to Cross Site Scripting (XSS). The vulnerability due to insufficient santization of the Role Name field within roles_list.php, allowing an attacker with admin privileges to inject malicious code into the field resulting in stored Cross Site Scripting