{"action":"Upgrade concrete5/concrete5 to 9.2.5 or later.","affected":[{"fixed":"9.2.5","introduced":"9.0.0RC1"}],"component":"concrete5/concrete5","cve_ids":["CVE-2024-1247"],"ecosystem":"Packagist","epss":0.01244,"exploited":false,"fixed_versions":["9.2.5"],"ghsa_id":"GHSA-q25h-jch8-gfrp","id":"tcs_01M5KF6TNWCVVJ30EFKVS732FJ","modified_at":"2024-02-16T08:23:23.444798Z","published_at":"2024-02-09T21:30:57Z","references":["https://osv.dev/vulnerability/GHSA-q25h-jch8-gfrp","https://nvd.nist.gov/vuln/detail/CVE-2024-1247","https://github.com/concretecms/concretecms/commit/59a07472ad6349a2c5fb455837a54ed1fe3f6953","https://documentation.concretecms.org/9-x/developers/introduction/version-history/925-release-notes","https://github.com/concretecms/concretecms","https://www.concretecms.org/about/project-news/security/2024-02-04-security-advisory"],"severity":{"label":"low","score":2},"sources":[{"source":"osv","source_id":"GHSA-q25h-jch8-gfrp","url":"https://osv.dev/vulnerability/GHSA-q25h-jch8-gfrp"}],"summary":"Concrete CMS vulnerable to stored XSS via the Role Name field"}