CyberRota Analysis
AI-GeneratedConcrete CMS versions 9 through 9.5.2 are vulnerable to a CSRF issue in the orphaned block removal panel, allowing remote attackers to delete all blocks from a page when an authenticated user with edit permissions is tricked into loading a crafted request. This results in permanent loss of content, as affected blocks are removed from both the page and the global Blocks table. Organizations using these versions of Concrete CMS should prioritize patching this vulnerability to prevent potential data loss and ensure content integrity.
Original NVD Description
Concrete CMS 9 through 9.5.2 did not validate a CSRF token in the orphaned block removal panel action (removeOrphanedBlocks). A remote attacker could craft a request that, when loaded by an authenticated user holding edit permission on the target page, deleted every block on that page's current version; blocks not aliased to another page or scrapbook entry were also removed from the global Blocks table and their block-type data table, permanently destroying the content. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.1 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.