GHSA-6mxw-2vhf-42g5
Concrete CMS vulnerable to Cross-Site Request Forgery (CSRF)
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | concrete5/concrete5 | < 9.4.8 | 9.4.8 |
Details
As written in the advisory (Markdown source, shown as plain text).
Concrete CMS below version 9.4.8 is subject to CSRF by a Rogue Administrator using the Anti-Spam Allowlist Group Configuration via group_id parameter which can leads to a security bypass since changes are saved prior to checking the CSRF token.
The Concrete CMS security team thanks z3rco for reporting
References
External links from the advisory. They lead to third-party sites.