CVE-2022-30119

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

XSS in /dashboard/reports/logs/view - old browsers only. When using Internet Explorer with the XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2. This cannot be exploited in modern-day web browsers due to an automatic input escape mechanism. Concrete CMS Security team ranked this vulnerability 2 with CVSS v3.1 Vector AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N. Thanks zeroinside for reporting.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jun 24, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-30128.8A vulnerability was found in oretnom23 Fast Food Ordering System. It has been rated as critical. Affected by this issue is some unknown funcCVE-2022-301206.1XSS in /dashboard/blocks/stacks/view_details/ - old browsers only. When using an older browser with built-in XSS protection disabled, insuffCVE-2022-301216.7The “LANDesk(R) Management Agent” service exposes a socket and once connected, it is possible to launch commands only for signed executablesCVE-2022-301227.5A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack.CVE-2022-3012310.0A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint aCVE-2022-301246.8An improper authentication vulnerability exists in Rocket.Chat Mobile App <4.14.1.22788 that allowed an attacker with physical access to a mCVE-2022-301265.5In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of serCVE-2022-301278.3Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2022-301288.3Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2022-301298.8Visual Studio Code Remote Code Execution VulnerabilityCVE-2022-30139.8A vulnerability classified as critical has been found in SourceCodester Simple Task Managing System. This affects an unknown part of the filCVE-2022-301303.3.NET Framework Denial of Service Vulnerability
CVE-2022-30119: Medium severity, CVSS 6.1 | Vulnix