GHSA-7VX2-5349-QJ99高危已审查已撤回

Withdrawn: ConcreteCMS vulnerable to Xpath injection attacks

OSV 1.4.0 · github-reviewed · 修改于 2023-06-07 02:32

发布时间

2022-12-06 08:30

GitHub 审查时间

2022-12-06 23:35

NVD 发布时间

2022-12-06 07:15

源文件

advisories/github-reviewed/2022/12/GHSA-7vx2-5349-qj99/GHSA-7vx2-5349-qj99.json

该公告已于 2023-06-07 02:32 撤回

内容仅用于保留外部引用，请不要将其当作仍然有效的安全结论。

公告说明

Withdrawn

This advisory has been withdrawn because it has been found not to be a security issue and withdrawn by its CNA. Please see the message from NVD here for more information. This link is maintained to preserve external references.

Original Description

ConcreteCMS v9.1.3 was discovered to be vulnerable to Xpath injection attacks. This vulnerability allows attackers to access sensitive XML data via a crafted payload injected into the URL path folder "3".

受影响的软件包

Packagist

concrete5/concrete5

ECOSYSTEM

标识信息

别名 / CVE

CVE-2022-46464

CWE

CWE-91

软件生态

Packagist

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

原始 OSV JSON

{
  "id": "GHSA-7vx2-5349-qj99",
  "aliases": [
    "CVE-2022-46464"
  ],
  "details": "## Withdrawn\nThis advisory has been withdrawn because it has been found not to be a security issue and withdrawn by its CNA. Please see the message from NVD [here](https://nvd.nist.gov/vuln/detail/CVE-2022-46464) for more information. This link is maintained to preserve external references.\n\n## Original Description \n\nConcreteCMS v9.1.3 was discovered to be vulnerable to Xpath injection attacks. This vulnerability allows attackers to access sensitive XML data via a crafted payload injected into the URL path folder \"3\".",
  "summary": "Withdrawn: ConcreteCMS vulnerable to Xpath injection attacks",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "9.1.3"
            }
          ]
        }
      ],
      "package": {
        "name": "concrete5/concrete5",
        "ecosystem": "Packagist"
      }
    }
  ],
  "modified": "2023-06-06T18:32:24Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
    }
  ],
  "published": "2022-12-06T00:30:16Z",
  "withdrawn": "2023-06-06T18:32:24Z",
  "references": [
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46464",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/concretecms/concretecms",
      "type": "PACKAGE"
    },
    {
      "url": "https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/concretecms.org/2022/concretecms-9.1.3",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-91"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": "2022-12-05T23:15:00Z",
    "github_reviewed_at": "2022-12-06T15:35:16Z"
  }
}