CVE-2022-43688
MEDIUM4.8EPSS 0.37%Concrete CMS vulnerable to Cross-site Scripting
發布日:2022/11/15修改日:2023/11/8
描述
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Stored Cross-Site Scripting (XSS) in icons since the Microsoft application tile color is not sanitized. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.
受影響套件(1)
- Packagist/concrete5/concrete5from 0, < 8.5.10
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM4.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
參考連結(10)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-43688
- PATCHhttps://github.com/concretecms/concretecms
- WEBhttps://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes
- WEBhttps://documentation.concretecms.org/developers/introduction/version-history/913-release-notes
- WEBhttps://github.com/concretecms/concretecms/commit/51f19b377a19c97a8b8f1d4d0f13724ed1c7c7a7
- WEBhttps://github.com/concretecms/concretecms/commit/6d46ca042fcfeda0f7881d8744f5216ef1abce0e
- WEBhttps://github.com/concretecms/concretecms/pull/10999
- WEBhttps://github.com/concretecms/concretecms/releases/8.5.10
- WEBhttps://github.com/concretecms/concretecms/releases/9.1.3
- WEBhttps://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31