CyberRota Analysis
AI-GeneratedIn Concrete CMS versions prior to 9.5.3, the SEO Bulk Update Meta Tags editor lacks proper per-page edit permission checks, allowing users with limited access to modify meta titles, descriptions, and URL handles of pages they cannot normally edit. This vulnerability can lead to unauthorized alterations of page presentation and URLs, potentially impacting SEO and content integrity. Organizations using affected versions should prioritize this issue, especially those with strict content management policies and SEO considerations.
Original NVD Description
In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving. The saveRecord() action validated the per-page CSRF token but never called canEditPageProperties() for the target page, so a user who was granted access to the bulk SEO tool and could view (but not edit) a given page was able to change that page's meta title, meta description, and URL handle outside their edit scope, tampering with the presentation and live URLs of otherwise protected content. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Andrew Gonzalez for reporting.