{"action":"Upgrade concrete5/concrete5 to 8.5.13 or later.","affected":[{"fixed":"8.5.13","introduced":"0"},{"fixed":"9.2.2","introduced":"9.0.0"}],"component":"concrete5/concrete5","cve_ids":["CVE-2023-48649"],"ecosystem":"Packagist","epss":0.00587,"exploited":false,"fixed_versions":["8.5.13","9.2.2"],"ghsa_id":"GHSA-36fr-3wg8-q5v8","id":"tcs_01M5KESP69E2271WZZGJEM2SES","modified_at":"2024-02-16T08:20:11.493026Z","published_at":"2023-11-17T06:31:21Z","references":["https://osv.dev/vulnerability/GHSA-36fr-3wg8-q5v8","https://nvd.nist.gov/vuln/detail/CVE-2023-48649","https://github.com/concretecms/concretecms/pull/11695","https://github.com/concretecms/concretecms/pull/11739","https://documentation.concretecms.org/developers/introduction/version-history/8513-release-notes","https://documentation.concretecms.org/developers/introduction/version-history/922-release-notes","https://github.com/concretecms/concretecms","https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release"],"severity":{"label":"low","score":3.5},"sources":[{"source":"osv","source_id":"GHSA-36fr-3wg8-q5v8","url":"https://osv.dev/vulnerability/GHSA-36fr-3wg8-q5v8"}],"summary":"Concrete CMS Cross-site Scripting vulnerability"}