CyberRota Analysis
AI-GeneratedConcrete CMS versions 9.0.0 and below are vulnerable to cross-site request forgery (CSRF) due to inadequate validation of CSRF tokens in the dashboard group type controller's delete action. This flaw allows a remote, unauthenticated attacker to manipulate authenticated users with group type management permissions into deleting custom group types. Organizations using Concrete CMS should prioritize patching this vulnerability, particularly those with user management functionalities exposed to untrusted networks.
Original NVD Description
Concrete CMS 9.0.0 to dashboard group type controller did not validate a CSRF token on its delete action, resulting in cross-site request forgery. A remote unauthenticated attacker could cause an authenticated user with group type management permission to delete a custom group type. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks riodrwn for reporting.