Winston Crooker

**Name of the Vulnerable Software and Affected Versions** Concrete CMS versions prior to 9.5.1 **Description** Cross-Site Request Forgery (CSRF) occurs via the `approveVersion()` function within the `BackendFile` class. An attacker can trick a user with `edit file contents` permissions into publishing a previously uploaded version of a file. This allows for the activation of an unpublished version from a co-editor or a downgrade to an older file version. **Recommendations** Update Concrete CMS to version 9.5.1 or later.

**Name of the Vulnerable Software and Affected Versions** Concrete CMS versions prior to 9.5.1 **Description** An Insecure Direct Object Reference (IDOR) and incorrect authorization level exist in the Express association Reorder dialog. This allows for cross-entity state tampering, where a user with view-only permissions on one entry can modify the state of another entity. This issue affects websites utilizing the Express module and relying on express entity ordering. **Recommendations** Update Concrete CMS to version 9.5.1 or later.

**Name of the Vulnerable Software and Affected Versions** Concrete CMS versions prior to 9.5.1 **Description** An authorization bypass exists in the Calendar Event Frontend Dialog. This flaw allows for cross-calendar data disclosure, where a public calendar block can be utilized as a pivot point to gain unauthorized access to private calendar data. **Recommendations** Update to a version newer than 9.5.0.

**Name of the Vulnerable Software and Affected Versions** Concrete CMS versions 9.5.0 and earlier **Description** An Insecure Direct Object Reference (IDOR), which occurs when an application provides direct access to objects based on user-supplied input, combined with a missing authentication gate allows unauthorized users to retrieve internal site structure data. By sending a GET request to the endpoint '/ccm/system/dialogs/file/usage/{fID}', an attacker can use the `fID` variable to obtain page IDs, versions, and URL paths. **Recommendations** Update to a version later than 9.5.0. As a temporary workaround, restrict access to the '/ccm/system/dialogs/file/usage/{fID}' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Concrete CMS versions prior to 9.5.1 **Description** Unauthenticated users can access page metadata on any page that has a configured summary template. This allows for the disclosure of private, draft, and restricted pages, leaking information such as the title, path, description, and author. **Recommendations** Update to a version newer than 9.5.0.