CVE-2024-2753

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.0.0 through 9.2.7 Concrete CMS versions prior to 8.5.16

Description The issue concerns a Stored XSS vulnerability on the calendar color settings screen. This occurs because user input is output without proper escaping, allowing a rogue administrator to inject malicious JavaScript into the Calendar Color Settings screen. This malicious code might be executed when users visit the affected page.

Recommendations For Concrete CMS versions 9.0.0 through 9.2.7, update to version 9.2.8 or later. For Concrete CMS versions prior to 8.5.16, update to version 8.5.16 or later. As a temporary workaround, consider restricting access to the calendar color settings screen to minimize the risk of exploitation.