-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| concrete5/concrete5 | composer | < 8.5.10 | 8.5.10 |
| concrete5/concrete5 | composer | >= 9.0.0, < 9.1.3 | 9.1.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from un-sanitized output in the multilingual report. Concrete CMS's release notes explicitly mention adding output sanitization to this component. XSS vulnerabilities typically occur when: 1) Controller methods pass raw user input to views, and 2) Views fail to escape dynamic content. The high-confidence controller method identification follows Concrete CMS's MVC pattern where dashboard reports are handled by dedicated controllers. The medium-confidence template identification acknowledges that XSS could also originate directly in view files if they contain unescaped output statements.