What is GHSA-fgxj-g7x3-85cq?

GHSA-fgxj-g7x3-85cq is a security advisory published by GitHub Security Advisories with Low severity. Stored cross site scripting in RSS displayer

Which CVE IDs does GHSA-fgxj-g7x3-85cq cover?

GHSA-fgxj-g7x3-85cq covers the following CVE IDs: CVE-2023-28820. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fgxj-g7x3-85cq?

GHSA-fgxj-g7x3-85cq has a CVSS v3 base score of 2.0, published by GitHub Security Advisories.

Which products are affected by GHSA-fgxj-g7x3-85cq?

GHSA-fgxj-g7x3-85cq affects 1 product, including: composer/concrete5/concrete5:\u003c 9.1.0.

GHSA-fgxj-g7x3-85cqLowCVSS 2.0

Stored cross site scripting in RSS displayer

Vendor

GitHub Security Advisories

Published

April 28, 2023

Last Modified

November 7, 2023

🔗 CVE IDs covered (1)

CVE-2023-28820 →

📋 Description

Concrete CMS (previously concrete5) before 9.1 is vulnerable to stored XSS in RSS Displayer via the href attribute because the link element input was not sanitized.

🎯 Affected products1

composer/concrete5/concrete5:< 9.1.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2023-28820
https://github.com/concretecms/concretecms/releases
https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20
https://github.com/advisories/GHSA-fgxj-g7x3-85cq