CVE-2023-28819

    Dashboard / Vulnerabilities / CVE-2023-28819

    CVE-2023-28819

    Published: 28 Apr 2023Last Modified: 12 Aug 2026

    Summary:

    Details: Concrete CMS (previously concrete5) versions 8.5.12 and below, 9.0.0 through 9.0.2 is vulnerable to Stored XSS in uploaded file and folder names.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28819.json, https://nvd.nist.gov/vuln/detail/CVE-2023-28819, https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20, https://github.com/concretecms/concretecms/releases, https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- b3774abddd475b4ba98b637402506f7a5ebd90ea
    Fixed -579e9f6339944de9f0134d59402d7fd7411f05c3

    Affected versions

    9.0.1
    9.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-28819 | CVE-DB