Security Advisory
CVE-2023-44766
4.8
MEDIUM
Vulnerability Description
A Cross Site Scripting (XSS) vulnerability in Concrete CMS v.9.2.1 allows an attacker to execute arbitrary code via a crafted script to the SEO - Extra from Page Settings. NOTE: the vendor disputes this because this SEO-related header change can only be made by an admin, and allowing an admin to place JavaScript there is an intentional customization feature.
Published Date
October 6, 2023
Official Source
NIST NVD Advisory