CyberRota Analysis
AI-GeneratedConcrete CMS versions prior to 9.5.3 are vulnerable due to insufficient validation of anti-CSRF tokens in the Calendar event duplication process. This flaw allows authenticated users with permission to add events to exploit the system, potentially creating unauthorized duplicate calendar events. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized event manipulation.
Original NVD Description
Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller (concrete/controllers/dialog/event/duplicate.php) submit() action, which duplicated a calendar event after checking only canAccess() and the per-resource canAddCalendarEvent() permission, so a crafted cross-site request could cause an authenticated user with add-event permission to create duplicate CalendarEvents and CalendarEventVersions records under their own authority. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.3 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.