CVE-2022-43693

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Concrete CMS is vulnerable to CSRF due to the lack of "State" parameter for external Concrete authentication service for users of Concrete who use the "out of the box" core OAuth.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notesRelease Notes, Vendor Advisory
https://documentation.concretecms.org/developers/introduction/version-history/913-release-notesRelease Notes, Vendor Advisory
https://github.com/concretecms/concretecms/releases/8.5.10Patch, Release Notes, Third Party Advisory
https://github.com/concretecms/concretecms/releases/9.1.3Patch, Release Notes, Third Party Advisory
https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31Vendor Advisory
https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notesRelease Notes, Vendor Advisory
https://documentation.concretecms.org/developers/introduction/version-history/913-release-notesRelease Notes, Vendor Advisory
https://github.com/concretecms/concretecms/releases/8.5.10Patch, Release Notes, Third Party Advisory
https://github.com/concretecms/concretecms/releases/9.1.3Patch, Release Notes, Third Party Advisory
https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31Vendor Advisory

Timeline

Published: Nov 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-436946.1Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the image manipulation library CVE-2022-436954.8Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Stored Cross-Site Scripting (XSS) in dashboard/s CVE-2022-436966.1OX App Suite before 7.10.6-rev20 allows XSS via upsell ads.CVE-2022-436976.1OX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob.CVE-2022-436984.3OX App Suite before 7.10.6-rev30 allows SSRF because changing a POP3 account disregards the deny-list.CVE-2022-436994.3OX App Suite before 7.10.6-rev30 allows SSRF because e-mail account discovery disregards the deny-list and thus can be attacked by an advers CVE-2022-43707.2The multimedial images WordPress plugin through 1.0b does not properly sanitize and escape a parameter before using it in a SQL statement, l CVE-2022-437017.8When the installation directory does not have sufficiently restrictive file permissions, an attacker can modify files in the installation di CVE-2022-437027.8When the directory containing the installer does not have sufficiently restrictive file permissions, an attacker can modify (or replace) the CVE-2022-437037.8An installer that loads or executes files using an unconstrained search path may be vulnerable to substitute files under control of an attac CVE-2022-437045.9The Sinilink XY-WFT1 WiFi Remote Thermostat, running firmware 1.3.6, allows an attacker to bypass the intended requirement to communicate us CVE-2022-437059.1In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1