CVE-2022-30120: XSS
XSS in /dashboard/blocks/stacks/viewdetails/ - old browsers only. When using an older browser with built-in XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 to allow XSS. This cannot be exploited in modern-day web browsers due to an automatic input escape mechanism. Concrete CMS Security team ranked this vulnerability 3.1with CVSS v3.1 Vector AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N. Sanitation has been added where built urls are output. Credit to Credit to Bogdan Tiron from FORTBRIDGE (https://www.fortbridge.co.uk/ ) for reporting
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-30120?
The severity of CVE-2022-30120 is medium (6.1).
Which versions of Concrete CMS are affected by CVE-2022-30120?
Concrete CMS versions 8.5.7 and below, as well as versions 9.0 through 9.0.2 are affected by CVE-2022-30120.
How can CVE-2022-30120 be exploited?
CVE-2022-30120 can be exploited by using an older browser with built-in XSS protection disabled, and by manipulating the outputted URLs with insufficient sanitation.
How can I fix CVE-2022-30120?
To fix CVE-2022-30120, it is recommended to upgrade to Concrete CMS version 8.5.8 or above.
Where can I find more information about CVE-2022-30120?
You can find more information about CVE-2022-30120 in the following references: [reference 1](https://documentation.concretecms.org/developers/introduction/version-history/858-release-notes), [reference 2](https://documentation.concretecms.org/developers/introduction/version-history/910-release-notes), and [reference 3](https://hackerone.com/reports/1363598).