CVE-2022-30120

Severity Score

6.1

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

XSS in /dashboard/blocks/stacks/view_details/ - old browsers only. When using an older browser with built-in XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 to allow XSS. This cannot be exploited in modern-day web browsers due to an automatic input escape mechanism. Concrete CMS Security team ranked this vulnerability 3.1with CVSS v3.1 Vector AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N. Sanitation has been added where built urls are output. Credit to Credit to Bogdan Tiron from FORTBRIDGE (https://www.fortbridge.co.uk/ ) for reporting

Una vulnerabilidad de tipo XSS en /dashboard/blocks/stacks/view_details/ - sólo para navegadores antiguos. Cuando es usado un navegador antiguo con la protección de tipo XSS incorporada deshabilitada, un saneo insuficiente en la salida de las urls construidas puede ser explotado para Concrete versiones 8.5.7 y anteriores, así como Concrete versiones 9.0 hasta 9.0.2 para permitir un ataque de tipo XSS. Esto no puede ser explotado en los navegadores web actuales debido a un mecanismo de escape de entrada automático. El equipo de seguridad de Concrete CMS clasificó esta vulnerabilidad como 3.1 con el vector CVSS v3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N. ha sido añadido el saneo en la salida de las urls construidas. Crédito a Bogdan Tiron de FORTBRIDGE (https://www.fortbridge.co.uk/ ) por reportar

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-05-02 CVE Reserved
2022-06-24 CVE Published
2024-01-15 EPSS Updated
2024-08-03 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CAPEC

References (2)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://documentation.concretecms.org/developers/introduction/version-history/858-release-notes	2022-07-05
https://documentation.concretecms.org/developers/introduction/version-history/910-release-notes	2022-07-05

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Concretecms Search vendor "Concretecms"		Concrete Cms Search vendor "Concretecms" for product "Concrete Cms"				< 8.5.8 Search vendor "Concretecms" for product "Concrete Cms" and version " < 8.5.8"		-		Affected
Concretecms Search vendor "Concretecms"		Concrete Cms Search vendor "Concretecms" for product "Concrete Cms"				>= 9.0.0 < 9.1.0 Search vendor "Concretecms" for product "Concrete Cms" and version " >= 9.0.0 < 9.1.0"		-		Affected