PT-2022-20009 · Microsoft · Internet Explorer

Zeroinside · Published 2022-06-24 · Updated 2022-07-05 · CVE-2022-30118

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 8.5.7 and below Concrete CMS versions 9.0 through 9.0.2

Description The issue allows for XSS when editing a form control in an express entities form using Internet Explorer with XSS protection disabled. This cannot be exploited in modern web browsers due to automatic input escape mechanisms. The estimated number of potentially affected devices is not provided.

Recommendations For Concrete CMS versions 8.5.7 and below, update to a version above 8.5.7 to resolve the issue. For Concrete CMS versions 9.0 through 9.0.2, update to a version above 9.0.2 to resolve the issue. As a temporary workaround, consider disabling the use of Internet Explorer or enabling XSS protection until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-30118

Affected Products

Internet Explorer

References · 6

• https://documentation.concretecms.org/developers/introduction/version-history/858-release-notes · Vendor Advisory
• https://documentation.concretecms.org/developers/introduction/version-history/910-release-notes · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30118 · Security Note
• https://osv.dev/vulnerability/CVE-2022-30118 · Vendor Advisory
• https://hackerone.com/reports/1370054 · Note
• https://t.me/cibsecurity/45095 · Telegram Post