PT-2022-26962 · Unknown · Concrete Cms

Akbar_Jafarli · Published 2022-12-05 · Updated 2022-12-07 · CVE-2022-43556

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Concrete CMS versions below 8.5.10 Concrete CMS versions 9.0.0 through 9.1.2

Description The issue concerns a lack of sanitization in the result dashboard page output for text input fields, leading to a potential XSS vulnerability. The Concrete CMS security team has reported this issue.

Recommendations For Concrete CMS versions below 8.5.10, update to Concrete CMS 8.5.10. For Concrete CMS versions 9.0.0 through 9.1.2, update to Concrete CMS 9.1.3.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-43556

GHSA-XJ33-8R43-R227

Affected Products

Concrete Cms

References · 9

• https://osv.dev/vulnerability/GHSA-xj33-8r43-r227 · Vendor Advisory
• https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes · Vendor Advisory
• https://concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31 · Vendor Advisory
• https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43556 · Security Note
• https://osv.dev/vulnerability/CVE-2022-43556 · Vendor Advisory
• https://github.com/concretecms/concretecms · Note
• https://t.me/cibsecurity/54034 · Telegram Post
• https://t.me/cvenotify/39193 · Telegram Post