GHSA-r7vr-wg3f-8hr9 json
Concrete5 CMS contains an XPath injection vulnerability
published 9mo ago modified 9mo ago also CVE-2022-50807
- cvss
- 9.8
- version 3.1, GitHub
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
Concrete5 CMS version 9.1.3 contains an XPath injection vulnerability that allows attackers to manipulate URL path parameters with malicious payloads. Attackers can flood the system with crafted requests to potentially extract internal content paths and system information.
Is GHSA-r7vr-wg3f-8hr9 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | concrete5/concrete5 | 1 listed version |
no fix listed |
Classification
- Weakness
-
- CWE-643 Improper Neutralization of Data within XPath Expressions
References
-
nvd.nist.gov
/vuln/detail/CVE-2022-50807
advisory
-
github.com
/concretecms/concretecms
package
-
github.com
/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/concretecms.org/2022/concretecms-9.1.3
web
-
concretecms.org
web
-
concretecms.org
/download
web
-
exploit-db.com
/exploits/51144
web
-
vulncheck.com
/advisories/concrete-cme-xpath-injection
web
Sources
- GitHub Advisory GHSA-r7vr-wg3f-8hr9
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.