PT-2022-27879 · Unknown · Concrete Cms

Published 2022-12-06 · Updated 2023-03-10 · CVE-2022-46464

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ConcreteCMS version 9.1.3

Description The issue allows attackers to access sensitive XML data via a crafted payload injected into the URL path folder "3". This is due to an Xpath injection vulnerability.

Recommendations For ConcreteCMS version 9.1.3, consider restricting access to the URL path folder "3" to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-91

Related Identifiers

CVE-2022-46464

GHSA-7VX2-5349-QJ99

Affected Products

Concrete Cms

References · 5

• 🔥 https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/concretecms.org/2022/concretecms-9.1.3 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-46464 · Security Note
• https://osv.dev/vulnerability/GHSA-7vx2-5349-qj99 · Vendor Advisory
• https://github.com/concretecms/concretecms · Note
• https://t.me/cvenotify/39318 · Telegram Post