{"action":"Upgrade concrete5/concrete5 to 9.2.5 or later.","affected":[{"fixed":"9.2.5","introduced":"9.0.0RC1"}],"component":"concrete5/concrete5","cve_ids":["CVE-2024-1246"],"ecosystem":"Packagist","epss":0.00453,"exploited":false,"fixed_versions":["9.2.5"],"ghsa_id":"GHSA-9v3w-cj7m-qh5g","id":"tcs_01M5KF0A3PXVN0B86TCXC5DBQG","modified_at":"2024-02-16T08:20:54.133245Z","published_at":"2024-02-09T21:30:57Z","references":["https://osv.dev/vulnerability/GHSA-9v3w-cj7m-qh5g","https://nvd.nist.gov/vuln/detail/CVE-2024-1246","https://github.com/concretecms/concretecms/commit/59a07472ad6349a2c5fb455837a54ed1fe3f6953","https://documentation.concretecms.org/9-x/developers/introduction/version-history/925-release-notes","https://github.com/concretecms/concretecms","https://www.concretecms.org/about/project-news/security/2024-02-04-security-advisory"],"severity":{"label":"low","score":2},"sources":[{"source":"osv","source_id":"GHSA-9v3w-cj7m-qh5g","url":"https://osv.dev/vulnerability/GHSA-9v3w-cj7m-qh5g"}],"summary":"Concrete CMS vulnerable to reflected XSS via the Image URL Import Feature"}