GitHub Advisoryadvisory · Packagist

GHSA-8699-h45g-7hm8 Concrete CMS Cross-site Scripting vulnerability

MEDIUM Published 2023-07-06 Modified 2025-05-14 Official page ↗
Aliases
CVE-2022-43695
Ecosystem
Packagist
Packages
concrete5/concrete5
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-77, CWE-79
Reviewed
2023-07-06

Affected packages

• Packagist concrete5/concrete5: < 8.5.10 → fixed in 8.5.10 • Packagist concrete5/concrete5: >= 9.0.0, < 9.1.3 → fixed in 9.1.3

Description

Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Stored Cross-Site Scripting (XSS) in dashboard/system/express/entities/associations because Concrete CMS allows association with an entity name that doesn’t exist or, if it does exist, contains XSS since it was not properly sanitized. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.

Related

Alias · CVE (1)

  • CVE-2022-43695 Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Stored Cross-Site Scripting (XSS) in… vulnerability

Weakness · CWE (2)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References