CyberRota Analysis
AI-GeneratedThe vulnerability affects Concrete CMS versions 9.2.0 through 9.5.2, where the REST API page update endpoint lacks proper authorization checks, allowing users with only content-editing rights to modify critical page properties, templates, and types. This flaw can lead to the injection of persistent JavaScript into the head element of pages, potentially compromising the security of all visitors, including privileged users. Organizations using affected versions of Concrete CMS should prioritize patching this vulnerability to mitigate the risk of unauthorized content manipulation and potential cross-site scripting attacks.
Original NVD Description
In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint (PUT /ccm/api/1.0/pages/{cID}) did not enforce page-property, page-template, or page-type authorization. A user granted only content-editing rights on a page could therefore alter its properties, template, and type through the API, and could set the header_extra_content attribute, which is rendered unescaped into the head element of every page, to persist JavaScript that executed in the browser of every visitor, including higher-privileged reviewers who approve the page version. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.2 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.