CVE-2021-3111

Name of the Vulnerable Software and Affected Versions Concrete5 version 8.5.4

Description The issue allows stored XSS via the name field of a new data object at the "index.php/dashboard/express/entries/view/" URI. This occurs in the Express Entries Dashboard.

Recommendations For Concrete5 version 8.5.4, update to a version that fixes this issue to prevent stored XSS attacks. As a temporary workaround, consider restricting access to the "index.php/dashboard/express/entries/view/" URI or disabling the ability to create new data objects in the Express Entries Dashboard until a patch is available. Avoid using the name field in the affected URI until the issue is resolved.