CVE-2022-30120XSS in /dashboard/blocks/stacks/view_details/ - old browsers only. When using an older browser with built-in XSS protection disabled,…
- 6.1MediumCVSS base score
- 1.0%Exploitation in 30 daysEPSS · top 36% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
XSS in /dashboard/blocks/stacks/view_details/ - old browsers only. When using an older browser with built-in XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 to allow XSS. This cannot be exploited in modern-day web browsers due to an automatic input escape mechanism. Concrete CMS Security team ranked this vulnerability 3.1with CVSS v3.1 Vector AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N. Sanitation has been added where built urls are output. Credit to Credit to Bogdan Tiron from FORTBRIDGE (https://www.fortbridge.co.uk/ ) for reporting
Timeline
ID reserved
By hackerone
- 53 days later
· 53 days later
Published
- 2 years later
· 2 years later
Record updated
- 2 years later
· 2 years later
EPSS rose above 1%
1.00% → 1.0%
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | Medium6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
- EPSS (exploitation in 30 days)
- 1.0% · top 36% of all CVEs (15 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.1.
Affected products
https://github.com/concrete5/concrete5
- affected Remediated in Concrete CMS 8.5.8 and 9.1.0. Affected Versions are Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Packagistconcrete5/coreGHSA-m2ww-6wv6-vw3c (opens in a new tab)
References
References3
- https://documentation.concretecms.org/developers/introduction/version-history/910-release-notes (opens in a new tab)x_refsource_MISCx_transferred
- https://documentation.concretecms.org/developers/introduction/version-history/858-release-notes (opens in a new tab)x_refsource_MISCx_transferred
- https://hackerone.com/reports/1363598 (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2022-6089 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-m2ww-6wv6-vw3c (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2022-30120)Record last updated .