Concrete CMS 9.5.0 (and all versions below) contains a Stored Cross-Site Scripting (Stored XSS) vulnerability in the handling of the “height” parameter. Because the Concrete CMS controller does not validate or sanitize the $height value, an attacker with editor privileges can store malicious JavaScript that will execute in the context of other visitors’ browsers when the affected content is viewed.
Technically, the root cause is improper input handling: the controller accepts the $height parameter and fails to validate/sanitize it before it is persisted and later rendered back to users. The attack vector is stored XSS, meaning the malicious payload is saved (e.g., via an editor action) and then triggered when any visitor loads the page that uses the stored height value. The exploitation mechanism is browser-based: when the stored value is rendered into the page (without proper output encoding/escaping), the injected script runs with the privileges of the victim’s session in the browser, enabling actions such as session hijacking or credential theft.
Impact: An attacker with editor privileges can execute arbitrary JavaScript in the browsers of other users who view the affected content. This can lead to session hijacking, credential theft, and other malicious actions performed as the victim user. The NVD description assigns a CVSS v4.0 score of 7.3 (vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N), indicating a high-impact client-side compromise (high confidentiality/integrity/availability impact in the browser context) with required privileges (PR:H) and user interaction (UI:P). Real-world risk is elevated for sites where editors are not fully trusted, since any stored payload can affect multiple visitors.
Mitigation: Upgrade Concrete CMS to a version newer than 9.5.0 where the height parameter is properly validated and/or output-encoded. The provided reference material is limited to 9.5.1 release notes and does not explicitly mention this specific Stored XSS issue in the height parameter, so the safest actionable guidance is to patch to the latest available Concrete CMS release and verify that the specific $height handling path is fixed (input validation and correct output escaping/encoding when rendering the height value). As a workaround (where patching is not immediately possible), restrict editor privileges to trusted users only, since exploitation requires editor-level access per the NVD description.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CWE-79