CVE-2022-43968

An attacker can craft a malicious URL containing JavaScript payload in a parameter that is reflected unsanitized on the dashboard icons page. When a logged-in administrator visits this crafted URL, the injected script executes in the context of the dashboard session. The attacker does not require authentication but relies on tricking an authenticated admin user to click the link. The vulnerability is classified as reflected XSS due to un-sanitized output [patch_id=1641211].

The vulnerability exists in the dashboard icons page of Concrete CMS. The advisory states that output on the icons dashboard page was not sanitized, leading to reflected XSS. The patch does not show the specific file or function changes, only the changelog entry referencing CVE-2022-43968.

The fix sanitizes output on the icons dashboard page before rendering it to the browser. The changelog entry for CVE-2022-43968 states "Sanitized output on the icons dashboard page to prevent reflected XSS" [patch_id=1641211]. By applying proper output encoding or sanitization, any attacker-supplied input is neutralized so it cannot execute as JavaScript. This closes the reflected XSS vector on that page.