VYPR
Moderate severityNVD Advisory· Published Nov 14, 2022· Updated May 13, 2025

CVE-2022-43695

CVE-2022-43695

Description

Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Stored Cross-Site Scripting (XSS) in dashboard/system/express/entities/associations because Concrete CMS allows association with an entity name that doesn’t exist or, if it does exist, contains XSS since it was not properly sanitized. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
concrete5/concrete5Packagist
< 8.5.108.5.10
concrete5/concrete5Packagist
>= 9.0.0, < 9.1.39.1.3

Affected products

2

Patches

Vulnerability mechanics

Root cause

"Missing output sanitization of entity names in the entity association dashboard page allows stored cross-site scripting."

Attack vector

An attacker with dashboard access can create or modify an Express entity and supply a name containing malicious JavaScript (e.g., `

Affected code

The vulnerability exists in the dashboard page at `/dashboard/system/express/entities/associations`. The code path that renders entity names in this dashboard page does not sanitize output, allowing stored XSS when an entity name containing malicious HTML/JavaScript is displayed.

What the fix does

The patch [patch_id=1641218] adds sanitization to entity names rendered on the entity association dashboard page. By escaping HTML output before displaying entity names, the fix prevents injected script tags or event handlers from executing in the browser. This closes the stored XSS vector that existed when unsanitized entity names were rendered in the dashboard interface.

Preconditions

  • authAttacker must have dashboard access to create or modify Express entities.
  • inputThe entity name field must accept arbitrary input without sanitization.

Generated on May 23, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

7

News mentions

0

No linked articles in our index yet.