Headline
GHSA-f55r-8rcv-mqcf: Missing secure cookie parameters
Concrete CMS (previously concrete5) before 9.2 does not have Secure and HTTP only attributes set for ccmPoll cookies.
Missing secure cookie parameters
Moderate severity GitHub Reviewed Published Apr 28, 2023 to the GitHub Advisory Database • Updated Apr 28, 2023
Related news
CVE-2023-48649: 2023-11-09 Security Blog about updated CVEs and new releases
Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows stored XSS on the Admin page via an uploaded file name.