CyberRota Analysis
AI-GeneratedConcrete CMS versions 9 through 9.5.2 are vulnerable due to inadequate authorization checks in the Boards area of the Dashboard, allowing users with board-edit rights to access and manipulate instances of other boards by supplying their instance IDs. This could lead to unauthorized viewing, refreshing, regenerating, or deletion of board instances, posing a risk to data integrity. Organizations using affected versions should prioritize this vulnerability to mitigate potential unauthorized access and data manipulation risks.
Original NVD Description
Concrete CMS 9 through 9.5.2 did not perform an authorization check on several board-instance actions in the Boards area of the Dashboard. The instance details single-page controller resolved a board instance directly from an attacker-supplied instance ID and then viewed, refreshed, regenerated, or deleted it without verifying that the requester held edit_board_settings on the instance's parent board. As a result, a user granted board-edit rights on a single board could reach the instances of any other board on the site by supplying their instance IDs. The affected actions bypassed the controller's permission-checked accessor (the same accessor used by the read view, which runs canEditBoardSettings on the parent board) and validated only an action-scoped CSRF token, which is bound to the action name rather than to the target object and is therefore reusable across boards. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.