XSS in /dashboard/blocks/stacks/view_details/ - old browsers only. When using an older browser with built-in XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 to allow XSS. This cannot be exploited in modern-day web browsers due to an automatic input escape mechanism. Concrete CMS Security team ranked this vulnerability 3.1with CVSS v3.1 Vector AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N. Sanitation has been added where built urls are output. Credit to Credit to Bogdan Tiron from FORTBRIDGE (https://www.fortbridge.co.uk/ ) for reporting
References
Link | Resource |
---|---|
https://documentation.concretecms.org/developers/introduction/version-history/858-release-notes | Release Notes Vendor Advisory |
https://documentation.concretecms.org/developers/introduction/version-history/910-release-notes | Release Notes Vendor Advisory |
https://hackerone.com/reports/1363598 | Permissions Required Third Party Advisory |
https://documentation.concretecms.org/developers/introduction/version-history/858-release-notes | Release Notes Vendor Advisory |
https://documentation.concretecms.org/developers/introduction/version-history/910-release-notes | Release Notes Vendor Advisory |
https://hackerone.com/reports/1363598 | Permissions Required Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 07:02
Type | Values Removed | Values Added |
---|---|---|
References | () https://documentation.concretecms.org/developers/introduction/version-history/858-release-notes - Release Notes, Vendor Advisory | |
References | () https://documentation.concretecms.org/developers/introduction/version-history/910-release-notes - Release Notes, Vendor Advisory | |
References | () https://hackerone.com/reports/1363598 - Permissions Required, Third Party Advisory |
05 Jul 2022, 19:42
Type | Values Removed | Values Added |
---|---|---|
References | (MISC) https://documentation.concretecms.org/developers/introduction/version-history/858-release-notes - Release Notes, Vendor Advisory | |
References | (MISC) https://documentation.concretecms.org/developers/introduction/version-history/910-release-notes - Release Notes, Vendor Advisory | |
References | (MISC) https://hackerone.com/reports/1363598 - Permissions Required, Third Party Advisory | |
CWE | CWE-79 | |
CPE | cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:* | |
CVSS |
v2 : v3 : |
v2 : 4.3
v3 : 6.1 |
24 Jun 2022, 15:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-06-24 15:15
Updated : 2024-11-21 07:02
NVD link : CVE-2022-30120
Mitre link : CVE-2022-30120
CVE.ORG link : CVE-2022-30120
JSON object : View
Products Affected
concretecms
- concrete_cms
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')