CVE-2022-30119

XSS in /dashboard/reports/logs/view - old browsers only. When using Internet Explorer with the XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2. This cannot be exploited in modern-day web browsers due to an automatic input escape mechanism. Concrete CMS Security team ranked this vulnerability 2 with CVSS v3.1 Vector AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N. Thanks zeroinside for reporting.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*
cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*

History

21 Nov 2024, 07:02

Type Values Removed Values Added
References () https://documentation.concretecms.org/developers/introduction/version-history/858-release-notes - Release Notes, Vendor Advisory () https://documentation.concretecms.org/developers/introduction/version-history/858-release-notes - Release Notes, Vendor Advisory
References () https://documentation.concretecms.org/developers/introduction/version-history/910-release-notes - Release Notes, Vendor Advisory () https://documentation.concretecms.org/developers/introduction/version-history/910-release-notes - Release Notes, Vendor Advisory
References () https://hackerone.com/reports/1370054 - Permissions Required, Third Party Advisory () https://hackerone.com/reports/1370054 - Permissions Required, Third Party Advisory

05 Jul 2022, 19:40

Type Values Removed Values Added
CWE CWE-79
CPE cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown
v2 : 4.3
v3 : 6.1
References (MISC) https://hackerone.com/reports/1370054 - (MISC) https://hackerone.com/reports/1370054 - Permissions Required, Third Party Advisory
References (MISC) https://documentation.concretecms.org/developers/introduction/version-history/858-release-notes - (MISC) https://documentation.concretecms.org/developers/introduction/version-history/858-release-notes - Release Notes, Vendor Advisory
References (MISC) https://documentation.concretecms.org/developers/introduction/version-history/910-release-notes - (MISC) https://documentation.concretecms.org/developers/introduction/version-history/910-release-notes - Release Notes, Vendor Advisory

24 Jun 2022, 15:15

Type Values Removed Values Added
New CVE

Information

Published : 2022-06-24 15:15

Updated : 2024-11-21 07:02


NVD link : CVE-2022-30119

Mitre link : CVE-2022-30119

CVE.ORG link : CVE-2022-30119


JSON object : View

Products Affected

concretecms

  • concrete_cms
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')