CVE-2022-43556: Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XSS in the text input field since the result dashboard page output…

PriorityP424medium6.1CVSS 3.1

AVNACLPRNUIRSCCLILAN

EPSS

0.61%

45.0th percentile

Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XSS in the text input field since the result dashboard page output is not sanitized. The Concrete CMS security team has ranked this 4.2 with CVSS v3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N Thanks @_akbar_jafarli_ for reporting. Remediate by updating to Concrete CMS 8.5.10 and Concrete CMS 9.1.3.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
concrete5	concrete5	>= 0 < 8.5.10	8.5.10
concrete5	concrete5	>= 9.0.0 < 9.1.3	9.1.3
concretecms	concrete_cms	< 8.5.10	8.5.10
concretecms	concrete_cms	9.0.0 – 9.1.2	—
https	github.com_concretecms_concretecms	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.