GHSA-8782-xgh5-r7mv
Concrete CMS vulnerable to Reflected Cross-Site Scripting via dashboard icons
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | concrete5/concrete5 | < 8.5.10 | 8.5.10 |
| Packagist | concrete5/concrete5 | >= 9.0.0, < 9.1.3 | 9.1.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the dashboard icons due to un-sanitized output. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2022-43968
- https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes
- https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes
- https://github.com/concretecms/concretecms
- https://github.com/concretecms/concretecms/releases/8.5.10
- https://github.com/concretecms/concretecms/releases/9.1.3
- https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31