9.2.8 Release Notes
Behavioral Improvements
Bug Fixes

    Fixed bug where c5:info console command would fail when run on a Concrete webroot if that webroot was not yet an installed Concrete site.
    Fixed bug where logout link in toolbar would not work when user was logged in as an editor who could not view the Dashboard (thanks ounziw)

Security Updates

    Created CVE-2024-2753 Stored XSS on the calendar color settings screen and fixed it with commit 11988 Prior to the fix, a rogue administrator could put malicious javascript on the Concrete CMS color setting screen which would have would have been triggered by and affected users who accessed the color settings screen. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 2.0 with a vector of AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N
    Thank you Rikuto Tauchi for reporting HackerOne 2433383.

    Created CVE-2024-3178 Cross-site Scripting (XSS) - Advanced File Search Filter and fixed it with commit 11988 for version 9 and commit 11989 for version 8. Prior to the fix, a rogue administrator could add malicious code in the file manager because of insufficient validation of administrator provided data. All administrators have access to the File Manager and hence could create a search filter with the malicious code attached. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 3.1 with a vector of AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L Thank you Guram (javakhishvili) for reporting HackerOne 949443

    Created CVE-2024-3179 Stored XSS in the Custom Class page editing and fixed it with commit 11988 for version 9 and commit 11989 for version 8. Prior to the fix, a rogue administrator could insert malicious code in the custom class field due to insufficient validation of administrator provided data. Concrete CMS version 9.2.8 and 8.5.13 no longer allow any non alphanumeric characters in this CSS class. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 3.1 with a vector of AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L Thank you Alexey Solovyev for reporting HackerOne 918129.

    Created and fixed [CVE-2024-3180] (https://nvd.nist.gov/vuln/detail/CVE-2024-3180) Prior to fix, stored XSS could be executed by a rogue administrator adding malicious code to the link-text field when creating a block of type file. Fixed with commit 11988 for version 9 and commit 11989 for version 8. The Concrete CMS security team gave this vulnerability a CVSS v3.1 sore of 3.1 with a vector of AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L Thank you Alexey Solovyev for reporting HackerOne 903356

    Created CVE-2024-3181 Stored XSS in the Search Field. Prior to the fix, stored XSS could be executed by an administrator changing a filter to which a rogue administrator had previously added malicious code. The Concrete Team fixed this with commit 11988 for version 9 and commit 11989 for version 8. Thank you Alexey Solovyev for reporting HackerOne 918142
	
9.2.7 Release Notes
Behavioral Improvements

    Improved display of certain UI elements when Concrete was used with non-Bedrock/Bootstrap themes.
    Back to Website button in Dashboard now uses the vanity URL instead of the cID URL (Thanks JohnTheFish)
    Add db charset and collation to environment report (thanks JohnTheFish)

Bug Fixes

    Fixed: Time selector in the calendar event dialog not showing all times.
    Fixed: Undefined array key "value"' in /concrete/attributes/date_time/controller.php under PHP 8.
    Fixed: Undefined array key 0' in /concrete/blocks/calendar_event/controller.php:224 under PHP 8.
    Fix pagination not working in clipboard side panel (thanks quentinnorbert0)
    Fix double encoding when displaying page template name (thanks quentinnorbert0)
    Fixed inability to clear date/time attributes using the built-in HTML datepicker clear link.
    Fixed bug when attempting to do an advanced search by time in the Logs (thanks Quentin-Gach)
    Fixed error where including an ampersand in your site name would cause it to be displayed as & in your site browser title.
    Fixed: Undefined property: Concrete\Block\Survey\Controller::$cID' in /concrete/blocks/survey/controller.php:206 under PHP 8.
    Fixed: Undefined variable $fID' in /concrete/single_pages/download_file.php:23 under certain conditions in PHP 8.
    Fixed error when attempting to log values that were non-scalar (thanks JohnTheFish)