Vulnerabilities > Concretecms

DATE CVE VULNERABILITY TITLE RISK
2022-12-05 CVE-2022-46464 XML Injection (aka Blind XPath Injection) vulnerability in Concretecms Concrete CMS 9.1.3
ConcreteCMS v9.1.3 was discovered to be vulnerable to Xpath injection attacks.
network
low complexity
concretecms CWE-91
7.5
2022-12-05 CVE-2022-43556 Cross-site Scripting vulnerability in Concretecms Concrete CMS
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XSS in the text input field since the result dashboard page output is not sanitized.
network
low complexity
concretecms CWE-79
6.1
2022-11-14 CVE-2022-43687 Session Fixation vulnerability in Concretecms Concrete CMS
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 does not issue a new session ID upon successful OAuth authentication.
network
low complexity
concretecms CWE-384
5.4
2022-11-14 CVE-2022-43688 Cross-site Scripting vulnerability in Concretecms Concrete CMS
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Stored Cross-Site Scripting (XSS) in icons since the Microsoft application tile color is not sanitized.
network
low complexity
concretecms CWE-79
4.8
2022-11-14 CVE-2022-43689 XXE vulnerability in Concretecms Concrete CMS
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XXE based DNS requests leading to IP disclosure.
network
low complexity
concretecms CWE-611
5.3
2022-11-14 CVE-2022-43690 Improper Authentication vulnerability in Concretecms Concrete CMS
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 did not use strict comparison for the legacy_salt so that limited authentication bypass could occur if using this functionality.
network
low complexity
concretecms CWE-287
6.3
2022-11-14 CVE-2022-43691 Cleartext Transmission of Sensitive Information vulnerability in Concretecms Concrete CMS
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 inadvertently disclose server-side sensitive information (secrets in environment variables and server information) when Debug Mode is left on in production.
network
low complexity
concretecms CWE-319
5.3
2022-11-14 CVE-2022-43695 Command Injection vulnerability in Concretecms Concrete CMS
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Stored Cross-Site Scripting (XSS) in dashboard/system/express/entities/associations because Concrete CMS allows association with an entity name that doesn’t exist or, if it does exist, contains XSS since it was not properly sanitized.
network
low complexity
concretecms CWE-77
4.8
2022-11-14 CVE-2022-43686 Resource Exhaustion vulnerability in Concretecms Concrete CMS
In Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2, the authTypeConcreteCookieMap table can be filled up causing a denial of service (high load).
network
low complexity
concretecms CWE-400
6.5
2022-11-14 CVE-2022-43967 Cross-site Scripting vulnerability in Concretecms Concrete CMS
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the multilingual report due to un-sanitized output.
network
low complexity
concretecms CWE-79
6.1