CVE-2022-43695: Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Stored Cross-Site Scripting (XSS) in…

PriorityP419medium4.8CVSS 3.1

AVNACLPRHUIRSCCLILAN

EPSS

0.60%

44.3th percentile

Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Stored Cross-Site Scripting (XSS) in dashboard/system/express/entities/associations because Concrete CMS allows association with an entity name that doesn’t exist or, if it does exist, contains XSS since it was not properly sanitized. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
concrete5	concrete5	>= 0 < 8.5.10	8.5.10
concrete5	concrete5	>= 9.0.0 < 9.1.3	9.1.3
concretecms	concrete_cms	< 8.5.10	8.5.10
concretecms	concrete_cms	9.0.0 – 9.1.2	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.