CyberRota Analysis
AI-GeneratedConcrete CMS versions prior to 9.5.4 are vulnerable due to inadequate re-validation of OAuth bearer tokens, allowing deactivated, deleted, or locked accounts to retain access to API resources until their tokens expire. This oversight poses a risk of unauthorized access to sensitive data, as the system fails to revoke tokens for users whose accounts are no longer active. Organizations using Concrete CMS should prioritize addressing this vulnerability to mitigate potential security breaches.
Original NVD Description
Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of the account the token had been issued to. The resource server's authorization validator confirmed only that a token existed, had not expired, and had not been explicitly revoked, and deactivating a user did not revoke that user's outstanding tokens. As a result, a deactivated user retained full access to /ccm/api/1.0/* for the remaining lifetime of any token already issued to them. The same gap applied to accounts that had been deleted or locked pending a forced password reset. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.0 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Myq Larson for reporting.
Related CVEs
Other vulnerabilities affecting the same vendor(s)