CVE-2022-50807
CVE-2022-50807 · Concrete5 CMS contains an XPath injection vulnerability
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Concrete5 CMS version 9.1.3 contains an XPath injection vulnerability that allows attackers to manipulate URL path parameters with malicious payloads. Attackers can flood the system with crafted requests to potentially extract internal content paths and system information.
CVSS 9.8 · Critical
- Published
- Updated
Stack: php
Affected products and versions
concrete5/concrete5 Packagist
- Versions
- 9.1.3
No fix published
Original sources
- https://nvd.nist.gov/vuln/detail/CVE-2022-50807
- https://github.com/concretecms/concretecms
- https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/concretecms.org/2022/concretecms-9.1.3
- https://www.concretecms.org
- https://www.concretecms.org/download
- https://www.exploit-db.com/exploits/51144
- https://www.vulncheck.com/advisories/concrete-cme-xpath-injection
- https://osv.dev/vulnerability/GHSA-r7vr-wg3f-8hr9