CVE-2022-50807
CVE-2022-50807 · Concrete5 CMS contains an XPath injection vulnerability
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Concrete5 CMS version 9.1.3 contains an XPath injection vulnerability that allows attackers to manipulate URL path parameters with malicious payloads. Attackers can flood the system with crafted requests to potentially extract internal content paths and system information.
CVSS 9.8 · Crítica
- Publicación
- Actualización
Pila tecnológica: php
Productos y versiones afectados
concrete5/concrete5 Packagist
- Versiones
- 9.1.3
Sin corrección publicada
Fuentes originales
- https://nvd.nist.gov/vuln/detail/CVE-2022-50807
- https://github.com/concretecms/concretecms
- https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/concretecms.org/2022/concretecms-9.1.3
- https://www.concretecms.org
- https://www.concretecms.org/download
- https://www.exploit-db.com/exploits/51144
- https://www.vulncheck.com/advisories/concrete-cme-xpath-injection
- https://osv.dev/vulnerability/GHSA-r7vr-wg3f-8hr9