CVE-2022-30119

 

Published at: - 24-06-2022 05:15

Last modified: - 05-07-2022 09:40

Total changes: - 3

Description

XSS in /dashboard/reports/logs/view - old browsers only. When using Internet Explorer with the XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2. This cannot be exploited in modern-day web browsers due to an automatic input escape mechanism. Concrete CMS Security team ranked this vulnerability 2 with CVSS v3.1 Vector AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N. Thanks zeroinside for reporting.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

 

Verification logic

 

Reference

• https://documentation.concretecms.org/developers/introduction/version-history/910-release-notes
• https://documentation.concretecms.org/developers/introduction/version-history/858-release-notes
• https://hackerone.com/reports/1370054

 

Keywords

NVD

 

CVE-2022-30119

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures