CVE-2022-43967
published 2022-11-14CVE-2022-43967: Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the multilingual report due to un-sanitized…
PriorityP424medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.59%
43.8th percentile
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the multilingual report due to un-sanitized output. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| concrete5 | concrete5 | >= 0 < 8.5.10 | 8.5.10 |
| concrete5 | concrete5 | >= 9.0.0 < 9.1.3 | 9.1.3 |
| concretecms | concrete_cms | < 8.5.10 | 8.5.10 |
| concretecms | concrete_cms | 9.0.0 – 9.1.2 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Concrete CMS vulnerable to Cross-site Scripting via multilingual report
ghsa·2022-11-15
CVE-2022-43967 [MEDIUM] CWE-79 Concrete CMS vulnerable to Cross-site Scripting via multilingual report
Concrete CMS vulnerable to Cross-site Scripting via multilingual report
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the multilingual report due to un-sanitized output. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.
OSV
Concrete CMS vulnerable to Cross-site Scripting via multilingual report
osv·2022-11-15
CVE-2022-43967 [MEDIUM] Concrete CMS vulnerable to Cross-site Scripting via multilingual report
Concrete CMS vulnerable to Cross-site Scripting via multilingual report
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the multilingual report due to un-sanitized output. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://documentation.concretecms.org/developers/introduction/version-history/8510-release-noteshttps://documentation.concretecms.org/developers/introduction/version-history/913-release-noteshttps://github.com/concretecms/concretecms/releases/8.5.10https://github.com/concretecms/concretecms/releases/9.1.3https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31https://documentation.concretecms.org/developers/introduction/version-history/8510-release-noteshttps://documentation.concretecms.org/developers/introduction/version-history/913-release-noteshttps://github.com/concretecms/concretecms/releases/8.5.10https://github.com/concretecms/concretecms/releases/9.1.3https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31
2022-11-14
Published