CVE-2022-43695

EUVD-2023-1998
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Stored Cross-Site Scripting (XSS) in dashboard/system/express/entities/associations because Concrete CMS allows association with an entity name that doesn’t exist or, if it does exist, contains XSS since it was not properly sanitized. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.8 MEDIUM
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CISA-ADPADP
4.8 MEDIUM
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 66%
Affected Products (NVD)
VendorProductVersion
concretecmsconcrete_cms
𝑥
< 8.5.10
concretecmsconcrete_cms
9.0.0 ≤
𝑥
≤ 9.1.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes
https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes
https://github.com/concretecms/concretecms/releases/8.5.10
https://github.com/concretecms/concretecms/releases/9.1.3
https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31
https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes
https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes
https://github.com/concretecms/concretecms/releases/8.5.10
https://github.com/concretecms/concretecms/releases/9.1.3
https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31