CVE-2022-43694: 
PHP vulnerability analysis and mitigation

Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the image manipulation library due to un-sanitized output. The vulnerability was discovered and reported by Bogdan and Adrian Tiron from FORTBRIDGE (Vendor Advisory).

The vulnerability exists in the API endpoint of the Image Manipulation Library where output is not properly sanitized, leading to potential reflected cross-site scripting attacks. The vulnerability has been assigned a CVSS v3.1 base score of 6.1 MEDIUM with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (NVD).

If exploited, this vulnerability could allow attackers to execute arbitrary web scripts or HTML in the context of the victim's browser when they interact with the affected image manipulation functionality. This could lead to theft of sensitive information or unauthorized actions performed on behalf of the victim (Vendor Advisory).

The vulnerability has been fixed in versions 8.5.10 and 9.1.3. Users are advised to upgrade to these or later versions. The fix involves properly sanitizing output in the API endpoint of the Image Manipulation Library (Release Notes).