CVE-2024-7512: concretecms concrete cms

csirt@kutim:~/threat-intel/cve/CVE-2024-7512

CVSS 4.8 · Medium EPSS 0,40%

Kerentanan Improper Input Validation pada concretecms concrete cms. Skor CVSS 3.1 4.8 (Medium) menurut NVD.

Deskripsi (NVD)

Concrete CMS versions 9.0.0 through 9.3.2 are affected by a stored XSS vulnerability in Board instances. A rogue administrator could inject malicious code. The Concrete CMS security team gave this vulnerability a CVSS 4.0 Score of 4.6 with vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Versions below 9 are not affected. Thanks, m3dium for reporting. (CNA updated AC score to L based on CVSS 4.0 documentation)

Rincian

Terbit di NVD: 12 Agustus 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 4.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-20: Improper Input Validation
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari): 0,40% peluang dieksploitasi; lebih tinggi dari 32,1% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
concretecms	concrete cms	Versi 9.0.0 hingga sebelum 9.3.3

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://documentation.concretecms.org/9-x/developers/introduction/version-history/933-release-notes?pk_vid=e36... release notes · advisory vendor
https://hackerone.com/reports/2486344 permissions required

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.