Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS04Njk5LWg0NWctN2htOM4AA0SM

Concrete CMS Cross-site Scripting vulnerability

Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Stored Cross-Site Scripting (XSS) in dashboard/system/express/entities/associations because Concrete CMS allows association with an entity name that doesn’t exist or, if it does exist, contains XSS since it was not properly sanitized. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.

Permalink: https://github.com/advisories/GHSA-8699-h45g-7hm8
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04Njk5LWg0NWctN2htOM4AA0SM
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 10 months ago
Updated: 9 months ago

CVSS Score: 4.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Identifiers: GHSA-8699-h45g-7hm8, CVE-2022-43695
References:

• https://nvd.nist.gov/vuln/detail/CVE-2022-43695
• https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes
• https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes
• https://github.com/concretecms/concretecms/releases/8.5.10
• https://github.com/concretecms/concretecms/releases/9.1.3
• https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31
• https://github.com/advisories/GHSA-8699-h45g-7hm8

Repository: https://github.com/concretecms/concretecms
Blast Radius: 4.1

Affected Packages