Aller au contenu
en Se connecter
Non notée

CVE-2022-30120 XSS in /dashboard/blocks/stacks/view_details/ - old browsers only

Description

XSS in /dashboard/blocks/stacks/view_details/ - old browsers only. When using an older browser with built-in XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 to allow XSS. This cannot be exploited in modern-day web browsers due to an automatic input escape mechanism. Concrete CMS Security team ranked this vulnerability 3.1with CVSS v3.1 Vector AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N. Sanitation has been added where built urls are output. Credit to Credit to Bogdan Tiron from FORTBRIDGE (https://www.fortbridge.co.uk/ ) for reporting

Produits et versions touchés

Produit Versions touchées Corrigé en
https://github.com/concrete5/concrete5 Versions non publiées

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de https://github.com/concrete5/concrete5

Les 16 CVE de https://github.com/concrete5/concrete5 →
CVE-2022-30118 Title for CVE: XSS in /dashboard/system/express/entities/forms/save_control/[GUID]: old browsers only.Description:… Non notée CVE-2022-21829 Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from… Non notée CVE-2022-30119 XSS in /dashboard/reports/logs/view - old browsers only Non notée CVE-2022-30117 Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload… Non notée
Suivre cette CVE