CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-43694
https://notcve.org/view.php?id=CVE-2022-43694
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the image manipulation library due to un-sanitized output. Concrete CMS (anteriormente concrete5) anterior a 8.5.10 y entre 9.0.0 y 9.1.2 es vulnerable a Reflected XSS en la librería de manipulación de imágenes debido a una salida no sanitizada. • https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes https://github.com/concretecms/concretecms/releases/8.5.10 https://github.com/concretecms/concretecms/releases/9.1.3 https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-43967
https://notcve.org/view.php?id=CVE-2022-43967
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the multilingual report due to un-sanitized output. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+. Concrete CMS (anteriormente concrete5) versiones inferiores a 8.5.10 y entre 9.0.0 y 9.1.2 es vulnerable a Reflected XSS en el informe multilingüe debido a una salida no sanitizada. Se corrige actualizando a Concrete CMS 9.1.3+ o 8.5.10+. • https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes https://github.com/concretecms/concretecms/releases/8.5.10 https://github.com/concretecms/concretecms/releases/9.1.3 https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2022-43691
https://notcve.org/view.php?id=CVE-2022-43691
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 inadvertently disclose server-side sensitive information (secrets in environment variables and server information) when Debug Mode is left on in production. Concrete CMS (anteriormente concrete5) anterior a 8.5.10 y entre 9.0.0 y 9.1.2 revela inadvertidamente información confidencial del lado del servidor (secretos en variables de entorno e información del servidor) cuando el modo de depuración se deja activado en producción. • https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes https://github.com/concretecms/concretecms/releases/8.5.10 https://github.com/concretecms/concretecms/releases/9.1.3 https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-43692
https://notcve.org/view.php?id=CVE-2022-43692
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS - user can cause an administrator to trigger reflected XSS with a url if the targeted administrator is using an old browser that lacks XSS protection. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+. Concrete CMS (anteriormente concrete5) anterior a 8.5.10 y entre 9.0.0 y 9.1.2 es vulnerable a Reflected XSS: el usuario puede hacer que un administrador active XSS reflejado con una URL si el administrador objetivo está utilizando un navegador antiguo que carece de protección XSS. Se corrige actualizando a Concrete CMS 9.1.3+ o 8.5.10+. • https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes https://github.com/concretecms/concretecms/releases/8.5.10 https://github.com/concretecms/concretecms/releases/9.1.3 https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.3EPSS: 0%CPEs: 2EXPL: 0CVE-2022-43690
https://notcve.org/view.php?id=CVE-2022-43690
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 did not use strict comparison for the legacy_salt so that limited authentication bypass could occur if using this functionality. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+. Concrete CMS (anteriormente concrete5) anterior a 8.5.10 y entre 9.0.0 y 9.1.2 no usó una comparación estricta para Legacy_salt, por lo que podría ocurrir una omisión de autenticación limitada si se usaba esta funcionalidad. Se corrige actualizando a Concrete CMS 9.1.3+ o 8.5.10+. • https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes https://github.com/concretecms/concretecms/releases/8.5.10 https://github.com/concretecms/concretecms/releases/9.1.3 https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31 •