PT-2022-20010 · Microsoft · Internet Explorer

Zeroinside · Published 2022-06-24 · Updated 2022-07-05 · CVE-2022-30119

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 8.5.7 and below Concrete CMS versions 9.0 through 9.0.2

Description The issue is related to insufficient sanitation of built URLs in the /dashboard/reports/logs/view endpoint, which can be exploited for XSS attacks. This can only be exploited when using old browsers, such as Internet Explorer with XSS protection disabled, due to the lack of automatic input escape mechanisms in these browsers.

Recommendations For Concrete CMS versions 8.5.7 and below, update to a version above 8.5.7 to resolve the issue. For Concrete CMS versions 9.0 through 9.0.2, update to a version above 9.0.2 to resolve the issue. As a temporary workaround, consider disabling the use of the /dashboard/reports/logs/view endpoint in old browsers until a patch is available. Restrict access to the /dashboard/reports/logs/view endpoint to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-30119

Affected Products

Internet Explorer

References · 5

• https://documentation.concretecms.org/developers/introduction/version-history/858-release-notes · Vendor Advisory
• https://documentation.concretecms.org/developers/introduction/version-history/910-release-notes · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-30119 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30119 · Security Note
• https://hackerone.com/reports/1370054 · Note