The vulnerability in Concrete CMS prior to version 9.5.3 involves missing anti-CSRF token validation on the block-arrangement backend endpoint (arrange() action of Concrete\Controller\Backend\Page\ArrangeBlocks). Although the endpoint requires page-edit authorization, it does not verify an anti-CSRF token and accepts any HTTP method. This allows an attacker to induce a signed-in content editor to perform unauthorized block rearrangements via a cross-site request forgery attack. The session cookie is sent due to the default null SameSite cookie configuration. The Concrete CMS security team assigned a CVSS v4.0 score of 2.3, indicating low severity.

An attacker can cause a signed-in content editor to unknowingly reorder or move blocks in the draft version of a page they are authorized to edit by exploiting the lack of anti-CSRF token validation. This could lead to unauthorized content changes within the CMS draft pages. The impact is limited to users with page-edit permissions and requires user interaction (UI). The vulnerability does not allow privilege escalation or direct data disclosure.

A fix is available in Concrete CMS version 9.5.3 and later, which adds proper anti-CSRF token validation to the block-arrangement backend endpoint. Users should upgrade to version 9.5.3 or later to remediate this vulnerability. No other mitigation steps are indicated by the vendor advisory.