CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-43556
https://notcve.org/view.php?id=CVE-2022-43556
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XSS in the text input field since the result dashboard page output is not sanitized. The Concrete CMS security team has ranked this 4.2 with CVSS v3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N Thanks @_akbar_jafarli_ for reporting. Remediate by updating to Concrete CMS 8.5.10 and Concrete CMS 9.1.3. Concrete CMS (anteriormente concrete5) anterior a 8.5.10 y entre 9.0.0 y 9.1.2 es vulnerable a XSS en el campo de entrada de texto, ya que la salida de la página del panel de resultados no está desinfectada. El equipo de seguridad de Concrete CMS ha clasificado este 4.2 con el vector CVSS v3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N Gracias @_akbar_jafarli_ por informes. • https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-43967
https://notcve.org/view.php?id=CVE-2022-43967
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the multilingual report due to un-sanitized output. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+. Concrete CMS (anteriormente concrete5) versiones inferiores a 8.5.10 y entre 9.0.0 y 9.1.2 es vulnerable a Reflected XSS en el informe multilingüe debido a una salida no sanitizada. Se corrige actualizando a Concrete CMS 9.1.3+ o 8.5.10+. • https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes https://github.com/concretecms/concretecms/releases/8.5.10 https://github.com/concretecms/concretecms/releases/9.1.3 https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-43686
https://notcve.org/view.php?id=CVE-2022-43686
In Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2, the authTypeConcreteCookieMap table can be filled up causing a denial of service (high load). En Concrete CMS (formerly concrete5) versiones anteriores a 8.5.10 y entre 9.0.0 y 9.1.2, la tabla authTypeConcreteCookieMap se puede llenar provocando una denegación de servicio (high load). • https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes https://github.com/concretecms/concretecms/releases/8.5.10 https://github.com/concretecms/concretecms/releases/9.1.3 https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2022-43691
https://notcve.org/view.php?id=CVE-2022-43691
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 inadvertently disclose server-side sensitive information (secrets in environment variables and server information) when Debug Mode is left on in production. Concrete CMS (anteriormente concrete5) anterior a 8.5.10 y entre 9.0.0 y 9.1.2 revela inadvertidamente información confidencial del lado del servidor (secretos en variables de entorno e información del servidor) cuando el modo de depuración se deja activado en producción. • https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes https://github.com/concretecms/concretecms/releases/8.5.10 https://github.com/concretecms/concretecms/releases/9.1.3 https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 6.3EPSS: 0%CPEs: 2EXPL: 0CVE-2022-43690
https://notcve.org/view.php?id=CVE-2022-43690
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 did not use strict comparison for the legacy_salt so that limited authentication bypass could occur if using this functionality. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+. Concrete CMS (anteriormente concrete5) anterior a 8.5.10 y entre 9.0.0 y 9.1.2 no usó una comparación estricta para Legacy_salt, por lo que podría ocurrir una omisión de autenticación limitada si se usaba esta funcionalidad. Se corrige actualizando a Concrete CMS 9.1.3+ o 8.5.10+. • https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes https://github.com/concretecms/concretecms/releases/8.5.10 https://github.com/concretecms/concretecms/releases/9.1.3 https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31 •