CVE-2022-30120: XSS
First published: Fri Jun 24 2022(Updated: )
XSS in /dashboard/blocks/stacks/view_details/ - old browsers only. When using an older browser with built-in XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 to allow XSS. This cannot be exploited in modern-day web browsers due to an automatic input escape mechanism. Concrete CMS Security team ranked this vulnerability 3.1with CVSS v3.1 Vector AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N. Sanitation has been added where built urls are output. Credit to Credit to Bogdan Tiron from FORTBRIDGE (https://www.fortbridge.co.uk/ ) for reporting
Credit: support@hackerone.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Concretecms Concrete Cms | <8.5.8 | |
| Concretecms Concrete Cms | >=9.0.0<9.1.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2022-30120?
The severity of CVE-2022-30120 is medium (6.1).
Which versions of Concrete CMS are affected by CVE-2022-30120?
Concrete CMS versions 8.5.7 and below, as well as versions 9.0 through 9.0.2 are affected by CVE-2022-30120.
How can CVE-2022-30120 be exploited?
CVE-2022-30120 can be exploited by using an older browser with built-in XSS protection disabled, and by manipulating the outputted URLs with insufficient sanitation.
How can I fix CVE-2022-30120?
To fix CVE-2022-30120, it is recommended to upgrade to Concrete CMS version 8.5.8 or above.
Where can I find more information about CVE-2022-30120?
You can find more information about CVE-2022-30120 in the following references: [reference 1](https://documentation.concretecms.org/developers/introduction/version-history/858-release-notes), [reference 2](https://documentation.concretecms.org/developers/introduction/version-history/910-release-notes), and [reference 3](https://hackerone.com/reports/1363598).
- collector/nvd-index
- agent/references
- agent/severity
- agent/author
- agent/weakness
- agent/type
- agent/description
- agent/event
- agent/last-modified-date
- agent/first-publish-date
- agent/tags
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- vendor/concretecms
- canonical/concretecms concrete cms
- version/concretecms concrete cms/9.0.0