CVE-2022-50807
CVE-2022-50807 · Concrete5 CMS contains an XPath injection vulnerability
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Concrete5 CMS version 9.1.3 contains an XPath injection vulnerability that allows attackers to manipulate URL path parameters with malicious payloads. Attackers can flood the system with crafted requests to potentially extract internal content paths and system information.
CVSS 9.8 · Critique
- Publication
- Mise à jour
Pile logicielle: php
Produits et versions concernés
concrete5/concrete5 Packagist
- Versions du logiciel
- 9.1.3
Aucun correctif publié
Sources originales
- https://nvd.nist.gov/vuln/detail/CVE-2022-50807
- https://github.com/concretecms/concretecms
- https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/concretecms.org/2022/concretecms-9.1.3
- https://www.concretecms.org
- https://www.concretecms.org/download
- https://www.exploit-db.com/exploits/51144
- https://www.vulncheck.com/advisories/concrete-cme-xpath-injection
- https://osv.dev/vulnerability/GHSA-r7vr-wg3f-8hr9