CVE-2022-30119

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

XSS in /dashboard/reports/logs/view - old browsers only. When using Internet Explorer with the XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2. This cannot be exploited in modern-day web browsers due to an automatic input escape mechanism. Concrete CMS Security team ranked this vulnerability 2 with CVSS v3.1 Vector AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N. Thanks zeroinside for reporting.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	https://github.com/concrete5/concrete5	Remediated in Concrete CMS 8.5.8 and 9.1.0. Affected Versions are Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2

References

https://documentation.concretecms.org/developers/introduction/version-history/858-release-notesRelease Notes, Vendor Advisory
https://documentation.concretecms.org/developers/introduction/version-history/910-release-notesRelease Notes, Vendor Advisory
https://hackerone.com/reports/1370054Permissions Required, Third Party Advisory
https://documentation.concretecms.org/developers/introduction/version-history/858-release-notesRelease Notes, Vendor Advisory
https://documentation.concretecms.org/developers/introduction/version-history/910-release-notesRelease Notes, Vendor Advisory
https://hackerone.com/reports/1370054Permissions Required, Third Party Advisory

Timeline

Published: Jun 24, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-30128.8A vulnerability was found in oretnom23 Fast Food Ordering System. It has been rated as critical. Affected by this issue is some unknown func CVE-2022-301206.1XSS in /dashboard/blocks/stacks/view_details/ - old browsers only. When using an older browser with built-in XSS protection disabled, insuff CVE-2022-301216.7The “LANDesk(R) Management Agent” service exposes a socket and once connected, it is possible to launch commands only for signed executables CVE-2022-301227.5A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack.CVE-2022-3012310.0A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint a CVE-2022-301246.8An improper authentication vulnerability exists in Rocket.Chat Mobile App <4.14.1.22788 that allowed an attacker with physical access to a m CVE-2022-301265.5In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of ser CVE-2022-301278.3Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability CVE-2022-301288.3Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability CVE-2022-301298.8Visual Studio Code Remote Code Execution Vulnerability CVE-2022-30139.8A vulnerability classified as critical has been found in SourceCodester Simple Task Managing System. This affects an unknown part of the fil CVE-2022-301303.3.NET Framework Denial of Service Vulnerability