CVE-2022-30119CWE-79

XSS in /dashboard/reports/logs/view - old browsers only

published June 24, 2022

CVSS
—
EPSS
1%
Percentile
59.2
In the wild
Unconfirmed
What it is

XSS in /dashboard/reports/logs/view - old browsers only. When using Internet Explorer with the XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2. This cannot be exploited in modern-day web browsers due to an automatic input escape mechanism. Concrete CMS Security team ranked this vulnerability 2 with CVSS v3.1 Vector AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N. Thanks zeroinside for reporting.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00897 · 59.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-06-24T14:59Z
EPSS history
Timeline
  • 24 JUN 14:59Z
    XSS in /dashboard/reports/logs/view - old browsers only
    cvelistv5