Lucene search

GoogleOSV:CVE-2022-43689

HistoryNov 14, 2022 - 11:15 p.m.

CVE-2022-43689

2022-11-1423:15:12

Google

osv.dev

concrete cms

xxe vulnerability

dns disclosure

ip disclosure

software

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

0.002 Low

EPSS

Percentile

54.6%

JSON

Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XXE based DNS requests leading to IP disclosure.

CPENameOperatorVersion
concretecmseq8.3.0
concretecmseq8.5.0RC1
concretecmseq5.7.5.5
concretecmseq8.2.1
concretecmseq5.7.2.1
concretecmseq8.5.6
concretecmseq8.4.1
concretecmseq5.7.0.1
concretecmseq5.7.5.6
concretecmseq5.7.5.10

Name	Operator	Version
concretecms	eq	8.3.0
concretecms	eq	8.5.0RC1
concretecms	eq	5.7.5.5
concretecms	eq	8.2.1
concretecms	eq	5.7.2.1
concretecms	eq	8.5.6
concretecms	eq	8.4.1
concretecms	eq	5.7.0.1
concretecms	eq	5.7.5.6
concretecms	eq	5.7.5.10

Rows per page:

1-10 of 571

References

documentation.concretecms.org/developers/introduction/version-history/8510-release-notes

documentation.concretecms.org/developers/introduction/version-history/913-release-notes

github.com/concretecms/concretecms/releases/8.5.10

github.com/concretecms/concretecms/releases/9.1.3

www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

0.002 Low

EPSS

Percentile

54.6%

JSON

Related for OSV:CVE-2022-43689