CVE-2022-30119

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-30119

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-30119.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-30119

Published

2022-06-24T15:15:10.960Z

Modified

2026-04-10T04:47:29.282907Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

XSS in /dashboard/reports/logs/view - old browsers only. When using Internet Explorer with the XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2. This cannot be exploited in modern-day web browsers due to an automatic input escape mechanism. Concrete CMS Security team ranked this vulnerability 2 with CVSS v3.1 Vector AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N. Thanks zeroinside for reporting.

References

Affected packages

Git / github.com/concretecms/concretecms

Affected ranges

Type

GIT

Repo

https://github.com/concretecms/concretecms

Events

Introduced

Fixed

f42593b79d0b4e1af1bdca3ead8235ab2c2757a6

Introduced

b3774abddd475b4ba98b637402506f7a5ebd90ea

Fixed

f1a0eb94bc70d74c58ec8746a7a940cf8257bf22

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "8.5.8"
        },
        {
            "introduced": "9.0.0"
        },
        {
            "fixed": "9.1.0"
        }
    ]
}

Affected versions

5.*

5.7.0

5.7.0.1

5.7.0.3

5.7.0.4

5.7.1

5.7.2

5.7.2.1

5.7.3

5.7.3.1

5.7.4.1

5.7.5.2

5.7.5.5

5.7.5.6

5.7.5.7

8.*

8.1.0

8.2.0

8.2.0RC2

8.2.1

8.3.1

8.4.1

8.5.6

8.5.7

9.*

9.0.0

9.0.1

9.0.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-30119.json"