CVE-2022-43967

An attacker can craft a URL containing malicious JavaScript payload in a parameter that the multilingual report reflects without sanitization. When a logged-in administrator visits this crafted URL, the payload executes in the context of the dashboard session. The attack requires no special privileges beyond the victim being authenticated to the Concrete CMS dashboard. The advisory classifies this as a reflected XSS vulnerability [patch_id=1641214].

The vulnerability exists in the multilingual dashboard report page. The advisory states that output was not sanitized before being rendered in this report [patch_id=1641214]. The exact file path is not shown in the patch, but the CHANGELOG entry confirms the affected component is the "multilingual dashboard report."

The fix sanitizes output in the multilingual dashboard report before rendering it to the browser. The CHANGELOG entry for version 8.5.10 explicitly states "Sanitized output in multilingual dashboard report to prevent reflected XSS" [patch_id=1641214]. By applying proper output encoding or escaping to user-controllable data displayed in this report, the application prevents injected HTML or JavaScript from being interpreted by the browser.