{"action":"Upgrade concrete5/concrete5 to 9.2.5 or later.","affected":[{"fixed":"9.2.5","introduced":"9.0.0RC1"}],"component":"concrete5/concrete5","cve_ids":["CVE-2024-1245"],"ecosystem":"Packagist","epss":0.004,"exploited":false,"fixed_versions":["9.2.5"],"ghsa_id":"GHSA-mgp6-j658-vcw9","id":"tcs_01M5KF5J622S8H8FF967PKXVS7","modified_at":"2024-02-16T08:08:02.439930Z","published_at":"2024-02-09T21:30:57Z","references":["https://osv.dev/vulnerability/GHSA-mgp6-j658-vcw9","https://nvd.nist.gov/vuln/detail/CVE-2024-1245","https://github.com/concretecms/concretecms/commit/59a07472ad6349a2c5fb455837a54ed1fe3f6953","https://documentation.concretecms.org/9-x/developers/introduction/version-history/925-release-notes","https://github.com/concretecms/concretecms","https://www.concretecms.org/about/project-news/security/2024-02-04-security-advisory"],"severity":{"label":"low","score":2.4},"sources":[{"source":"osv","source_id":"GHSA-mgp6-j658-vcw9","url":"https://osv.dev/vulnerability/GHSA-mgp6-j658-vcw9"}],"summary":"Concrete CMS vulnerable to stored XSS in file tags and description attributes"}