CVE-2024-1246: 
PHP vulnerability analysis and mitigation

Concrete CMS version 9 before 9.2.5 contains a reflected Cross-Site Scripting (XSS) vulnerability in the Image URL Import Feature. The vulnerability exists due to insufficient validation of administrator-provided data (Vendor Advisory, Release Notes).

The vulnerability is tracked as CVE-2024-1246 and has been assigned a CVSS v3.1 base score of 4.8 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) by NIST, while the vendor scored it as 2.0 LOW (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N). The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD).

If exploited, a rogue administrator could inject malicious code when importing images, which could then be executed in the website user's browser (Vendor Advisory).

The vulnerability requires high privileges (administrator access) and user interaction to be exploited. The attack vector is network-based, though the complexity of exploitation is debated between the vendor (high) and NIST (low) assessments (NVD).

The vulnerability has been fixed in Concrete CMS version 9.2.5. Users are advised to upgrade to this version or later to address the security issue (Release Notes).