Sign In
Advisories

Concrete5 CME 9.1.3 - Xpath injection

Go Back
severity
medium
date
Affecting

  • Concrete CMS 9.1.3

CWE
  • CWE-643 Improper Neutralization of Data within XPath Expressions ('XPath Injection')
CVSS
6.9
CVSS V4 Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
Credit
nu11secur1ty
Description
Concrete5 CMS version 9.1.3 contains an XPath injection vulnerability that allows attackers to manipulate URL path parameters with malicious payloads. Attackers can flood the system with crafted requests to potentially extract internal content paths and system information.