CVE-2024-7398

Concrete CMS versions 9 through 9.3.3 and versions below 8.5.19 are vulnerable to stored XSS in the calendar event addition feature because the calendar event name was not sanitized on output. Users or groups with permission to create event calendars can embed scripts, and users or groups with permission to modify event calendars can execute scripts. The Concrete CMS Security Team gave this vulnerability a CVSS v4 score of 4.6 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N Thank you, Yusuke Uchida for reporting. CNA updated this risk rank on 20 Jan 2025 by lowering the AC based on CVSS 4.0 documentation that access privileges should not be considered for AC)

• CWE-79
• CWE-79

• https://documentation.concretecms.org/9-x/developers/introduction/version-history/934-release-notesRelease Notes
• https://documentation.concretecms.org/developers/introduction/version-history/8519-release-notesRelease Notes
• https://github.com/concretecms/concretecms/commit/7c8ed0d1d9db0d7f6df7fa066e0858ea618451a5Patch
• https://github.com/concretecms/concretecms/pull/12183Patch
• https://github.com/concretecms/concretecms/pull/12184Patch

Published

Sep 25, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-7392ChargePoint Home Flex Bluetooth Low Energy Denial-of-Service…6.5
• CVE-2024-7393Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-7394Concrete CMS versions 9 through 9.3.2 and below 8.5.18 are v…4.8
• CVE-2024-7395An authentication bypass vulnerability in Korenix JetPort 56…9.3
• CVE-2024-7396Missing encryption of sensitive data in Korenix JetPort 5601…7.1
• CVE-2024-7397Improper filering of special characters result in a command …9.3
• CVE-2024-7399Improper limitation of a pathname to a restricted directory …9.8
• CVE-2024-7400The vulnerability potentially allowed an attacker to misuse …8.5
• CVE-2024-7401Netskope was notified about a security gap in Netskope Clien…7.5
• CVE-2024-7402Netskope has identified a potential gap in its agent (Netsko…7
• CVE-2024-7403Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-7404An issue was discovered in GitLab CE/EE affecting all versio…6.5