CVE-2023-28475

medium

Description

Concrete CMS (previously concrete5) versions 8.5.12 and below, and versions 9.0 through 9.1.3 is vulnerable to Reflected XSS on the Reply form because msgID was not sanitized.

References

https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20

https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release

https://concretecms.com

Details

Source: Mitre, NVD

Published: 2023-04-28

Updated: 2026-06-17

Risk Information

CVSS v2

Base Score: 6.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 6.1

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N