CVE-2022-30120

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

XSS in /dashboard/blocks/stacks/view_details/ - old browsers only. When using an older browser with built-in XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 to allow XSS. This cannot be exploited in modern-day web browsers due to an automatic input escape mechanism. Concrete CMS Security team ranked this vulnerability 3.1with CVSS v3.1 Vector AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N. Sanitation has been added where built urls are output. Credit to Credit to Bogdan Tiron from FORTBRIDGE (https://www.fortbridge.co.uk/ ) for reporting

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jun 24, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-301216.7The “LANDesk(R) Management Agent” service exposes a socket and once connected, it is possible to launch commands only for signed executablesCVE-2022-301227.5A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack.CVE-2022-3012310.0A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint aCVE-2022-301246.8An improper authentication vulnerability exists in Rocket.Chat Mobile App <4.14.1.22788 that allowed an attacker with physical access to a mCVE-2022-301265.5In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of serCVE-2022-301278.3Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2022-301288.3Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2022-301298.8Visual Studio Code Remote Code Execution VulnerabilityCVE-2022-30139.8A vulnerability classified as critical has been found in SourceCodester Simple Task Managing System. This affects an unknown part of the filCVE-2022-301303.3.NET Framework Denial of Service VulnerabilityCVE-2022-301317.8Windows Container Isolation FS Filter Driver Elevation of Privilege VulnerabilityCVE-2022-301327.8Windows Container Manager Service Elevation of Privilege Vulnerability