CVE-2024-3180: 
PHP vulnerability analysis and mitigation

Concrete CMS version 9 below 9.2.8 and previous versions below 8.5.16 are affected by a Stored Cross-Site Scripting (XSS) vulnerability in blocks of type file. The vulnerability was discovered by Alexey Solovyev and was disclosed on April 3, 2024 (NVD, Release Notes).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The issue stems from insufficient validation of administrator-provided data in the link-text field when creating a block of type file. The vulnerability has received a CVSS v3.1 base score of 4.8 MEDIUM from NIST (vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) and 3.1 LOW from ConcreteCMS (vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L) (NVD).

The vulnerability allows a rogue administrator to add malicious code to the link-text field when creating a block of type file, potentially affecting users who interact with the affected blocks (Release Notes).

The vulnerability requires high privileges (administrator access) and user interaction to be exploited. The attack complexity is considered low according to NIST's assessment, though ConcreteCMS rates it as high (NVD).

The vulnerability has been fixed in Concrete CMS versions 9.2.8 and 8.5.16. The fix was implemented with commit 11988 for version 9 and commit 11989 for version 8. Users are advised to upgrade to these versions or later to mitigate the vulnerability (Release Notes).