{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"8.1.0"}],"component":"concrete5/concrete5","cve_ids":["CVE-2017-7725"],"ecosystem":"Packagist","epss":0.02752,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-2mvg-c6mg-3q63","id":"tcs_01M5KES34WKND4DF8Y6HHGKGA0","modified_at":"2024-02-19T05:24:24.430317Z","published_at":"2022-05-13T01:08:38Z","references":["https://osv.dev/vulnerability/GHSA-2mvg-c6mg-3q63","https://nvd.nist.gov/vuln/detail/CVE-2017-7725","https://hackerone.com/reports/148300","https://packetstormsecurity.com/files/142145/concrete5-8.1.0-Host-Header-Injection.html","https://web.archive.org/web/20210124030008/https://www.securityfocus.com/bid/97649","https://www.exploit-db.com/exploits/41885","http://hyp3rlinx.altervista.org/advisories/CONCRETE5-v8.1.0-HOST-HEADER-INJECTION.txt"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-2mvg-c6mg-3q63","url":"https://osv.dev/vulnerability/GHSA-2mvg-c6mg-3q63"}],"summary":"Concrete CMS vulnerable to cross-site scripting (XSS)"}