Threats tagged 'ghsa-w9w6-c7x9-chcx'

Concrete CMS versions below 9.5.3 have a vulnerability where the block-arrangement backend endpoint (arrange() action) does not validate an anti-CSRF token. Although the action enforces page-edit authorization, it lacks token verification and accepts any HTTP method. This allows an attacker to trick a signed-in content editor into submitting a forged request that reorders or moves blocks in a draft page the editor can modify. The default null cookie SameSite setting permits the victim's session cookie to be sent with the forged request. The vulnerability has a low CVSS v4.0 score of 2.3.