Lucene search

GoogleOSV:CVE-2022-43688

HistoryNov 14, 2022 - 11:15 p.m.

CVE-2022-43688

2022-11-1423:15:12

Google

osv.dev

concrete cms

stored cross-site scripting

vulnerability

update

4.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

50.6%

JSON

Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Stored Cross-Site Scripting (XSS) in icons since the Microsoft application tile color is not sanitized. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.

CPENameOperatorVersion
concretecmseq8.3.0
concretecmseq8.5.0RC1
concretecmseq5.7.5.5
concretecmseq8.2.1
concretecmseq5.7.2.1
concretecmseq8.5.6
concretecmseq8.4.1
concretecmseq5.7.0.1
concretecmseq5.7.5.6
concretecmseq5.7.5.10

Name	Operator	Version
concretecms	eq	8.3.0
concretecms	eq	8.5.0RC1
concretecms	eq	5.7.5.5
concretecms	eq	8.2.1
concretecms	eq	5.7.2.1
concretecms	eq	8.5.6
concretecms	eq	8.4.1
concretecms	eq	5.7.0.1
concretecms	eq	5.7.5.6
concretecms	eq	5.7.5.10

Rows per page:

1-10 of 571

References

documentation.concretecms.org/developers/introduction/version-history/8510-release-notes

documentation.concretecms.org/developers/introduction/version-history/913-release-notes

github.com/concretecms/concretecms/releases/8.5.10

github.com/concretecms/concretecms/releases/9.1.3

www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31