VulnerabilityModified
CVE-2022-43694
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the image manipulation library due to un-sanitized output.
MEDIUM 6.1EPSS 0.62%
Does this matter?
Lower severity and a low EPSS score (0.62%). Track it; it rarely justifies an emergency change on its own.
Description
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the image manipulation library due to un-sanitized output.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.62% probability · 48th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- concretecms/concrete cms
- Source
- cve@mitre.org
References
- https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notesRelease Notes, Vendor Advisory
- https://documentation.concretecms.org/developers/introduction/version-history/913-release-notesRelease Notes, Vendor Advisory
- https://github.com/concretecms/concretecms/releases/8.5.10Patch, Release Notes, Third Party Advisory
- https://github.com/concretecms/concretecms/releases/9.1.3Patch, Release Notes, Third Party Advisory
- https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31Vendor Advisory
- https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notesRelease Notes, Vendor Advisory
- https://documentation.concretecms.org/developers/introduction/version-history/913-release-notesRelease Notes, Vendor Advisory
- https://github.com/concretecms/concretecms/releases/8.5.10Patch, Release Notes, Third Party Advisory
- https://github.com/concretecms/concretecms/releases/9.1.3Patch, Release Notes, Third Party Advisory
- https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.