CVE-2022-43692: XSS
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS - user can cause an administrator to trigger reflected XSS with a url if the targeted administrator is using an old browser that lacks XSS protection. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Concrete CMS (formerly concrete5)to a version that resolves this vulnerability.Fixed in 9.1.3 - Upgrade
Upgrade
Concrete CMS (formerly concrete5)to a version that resolves this vulnerability.Fixed in 8.5.10
Event History
Frequently Asked Questions
What is CVE-2022-43692?
CVE-2022-43692 is a vulnerability in Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 that allows a user to trigger reflected XSS in an administrator's browser if they are using an old browser without XSS protection.
How severe is CVE-2022-43692?
CVE-2022-43692 has a severity rating of 6.1 (medium).
How can I fix CVE-2022-43692?
To fix CVE-2022-43692, you need to update your Concrete CMS installation to version 9.1.3 or higher.
What is Concrete CMS?
Concrete CMS is a content management system (CMS) that was formerly known as concrete5.
What is reflected XSS?
Reflected XSS is a type of cross-site scripting vulnerability where the malicious script is embedded in a URL and executed when the victim clicks on the manipulated URL.