CVE-2014-5108

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-07-28 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in single_pages\download_file.php in concrete5 before 5.6.3 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to index.php/download_file.

Affected products

Concrete5: 5.5.0, 5.5.1, 5.5.2, 5.5.2.1, 5.6.0, 5.6.0.1 (+1)
Concrete CMS: 5.4.2, 5.4.2.1, 5.4.2.2, 5.6.1, 5.6.1.1, 5.6.1.2 (+2)

References

http://osvdb.org/show/osvdb/109273
http://packetstormsecurity.com/files/127493/Concrete-5.6.2.1-REFERER-Cross-Site-Scripting.html
http://www.securityfocus.com/bid/68685
https://www.concrete5.org/documentation/background/version_history/5-6-3-release-notes
http://osvdb.org/show/osvdb/109273
http://packetstormsecurity.com/files/127493/Concrete-5.6.2.1-REFERER-Cross-Site-Scripting.html
http://www.securityfocus.com/bid/68685
https://www.concrete5.org/documentation/background/version_history/5-6-3-release-notes

Get alerted when CVE-2014-5108 or the next vulnerability affects your stack