CVE-2022-30120CWE-79

XSS in /dashboard/blocks/stacks/view_details/ - old browsers only

published June 24, 2022

CVSS
—
EPSS
1%
Percentile
62.5
In the wild
Unconfirmed
What it is

XSS in /dashboard/blocks/stacks/view_details/ - old browsers only. When using an older browser with built-in XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 to allow XSS. This cannot be exploited in modern-day web browsers due to an automatic input escape mechanism. Concrete CMS Security team ranked this vulnerability 3.1with CVSS v3.1 Vector AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N. Sanitation has been added where built urls are output. Credit to Credit to Bogdan Tiron from FORTBRIDGE (https://www.fortbridge.co.uk/ ) for reporting

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00999 · 62.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-06-24T15:00Z
EPSS history
Timeline
  • 24 JUN 15:00Z
    XSS in /dashboard/blocks/stacks/view_details/ - old browsers only
    cvelistv5