CyberRota Analysis
AI-GeneratedConcrete CMS versions prior to 9.5.3 are vulnerable due to a lack of per-page authorization checks when reordering pages in the sitemap, allowing authenticated users without proper permissions to alter the global navigation order. This could lead to unauthorized manipulation of site structure, potentially impacting user experience and site integrity. Organizations using Concrete CMS should prioritize patching to mitigate this low-severity vulnerability, especially those with multiple users who have varying access levels.
Original NVD Description
Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, the send_to_top and send_to_bottom reorder tasks ran after only a generic sitemap-access check; the controller loaded the page named by the attacker-controlled cNodeID parameter and changed its display order without verifying that the current user held move or arrange permission on that specific page. Because of this, an authenticated user who could reach the sitemap but had no edit or arrange rights on a given page could still move that page and alter the site's global navigation order. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Andrew Gonzalez for reporting.