Concrete5 CMS contains an XPath injection vulnerability
Concrete5 CMS version 9.1.3 contains an XPath injection vulnerability that allows attackers to manipulate URL path parameters with malicious payloads. Attackers can flood the system with crafted requests to potentially extract internal content paths and system information.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-50807US | — | — | ||
Rejected reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/concretecms/concretecmsPACKAGE
- https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/concretecms.org/2022/concretecms-9.1.3WEB
- https://nvd.nist.gov/vuln/detail/CVE-2022-50807ADVISORY
- https://www.concretecms.orgWEB
- https://www.concretecms.org/downloadWEB
- https://www.exploit-db.com/exploits/51144WEB
- https://www.vulncheck.com/advisories/concrete-cme-xpath-injectionWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan