CVE Vulnerability Catalog

Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass. The user-profile edit controller passes the entire raw POST array to UserInfo::update() without field whitelisting resulting in password change without requiring the current password and also resulting in registered users able to disable the per-user-IP-pinning in the session validator which is meant to detect hijacking.

Concrete CMS version 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection. The pagination function directly interpolates the $URL field into the href attribute, allowing an authenticated admin or report viewer to execute JavaScript by clicking a crafted link.

Concrete CMS 9.5.0 and below is vulnerable to unauthenticated page metadata disclosure across every page with a configured summary template, revealing the existence of private, draft, and restricted pages while leaking title, path, description, and author information.

Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/get_rating' endpoint confirms existence and returns rating score for any message by ID.

Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/message_page' endpoint returns the full content of any conversation message. An unauthenticated attacker can enumerate all conversation messages, including messages from restricted pages, member-only areas, and the moderation queue. File attachments with download URLs are also exposed.

Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/message_detail' endpoint returns the full content of any conversation message. An unauthenticated attacker can enumerate all conversation messages, including messages from restricted pages, member-only areas, and the moderation queue. File attachments with download URLs are also exposed.

Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate. The endpoint '/ccm/system/dialogs/file/usage/{fID}' accepts an integer file ID in the URL and returns internal site structure data (page IDs, versions, URL paths) to anyone who sends a GET request.

Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName because updateCollectionAliasExternal bypasses sanitization. A rogue editor can inject arbitrary JavaScript.

In Concrete CMS 9.5.0 and below, the RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation, enabling redirect-to-internal bypasses.

In Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler bypasses account status. A user with uIsActive=0 (suspended, banned, terminated employee) can still authenticate via OAuth and receive valid API tokens.

Concrete CMS version 9.5.0 and below is vulnerable to IDOR in the AddMessage and UpdateMessage controllers via the attachments[] parameter. They lack per-file permission checks (canViewFile()), allowing a user who can post in any conversation to reference any file in the CMS file manager by its ID, bypassing the permission system.

Concrete CMS version 9.5.0 and below is vulnerable to unauthorized file deletion due to an inverted CSRF token check in the DeleteFile controller. The CSRF token is rejected when valid and accepted when invalid, enabling CSRF attacks against users with permission to edit conversation messages.

Concrete CMS 9.5.0 and below is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block via the exEntryID parameter. This IDOR leads to unauthorized access to all Express form submissions.

In Concrete CMS 9.5.0 and below, the submit_password() method in concrete/controllers/single_page/download_file.php allows unauthorized file access since downloading permission-restricted files bypasses the view_file permission check. Files without passwords can be downloaded and any user who knows a file's password can download a password protected file regardless of whether they have permission to access the file.

Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks. These versions use Perl's built-in eq comparison. Discrepencies in timing could be used to guess the underlying hash or password.

Simple Hierarchical Select (SHS) for Drupal 7 versions 7.x-1.0 through 7.x-1.10 contains a cross-site scripting vulnerability due to improper output escaping of term-derived text. Affected paths include shs_field_formatter_view and shs_term_get_children. Malicious taxonomy term names can be rendered unsafely depending on output context.

In the Drupal 7 Term Reference Tree module, two stored XSS vectors exist in the widget/formatter rendering pipeline. Vector A: when the Token module is enabled and token display templates are configured, attacker-controlled token output is rendered without proper sanitization. Vector B: taxonomy term labels are not properly sanitized before rendering, allowing script injection. Affects versions 7.x-1.x up to and including 7.x-1.11.

Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module. Low-privileged authenticated attackers can execute arbitrary JavaScript in the browser context of administrators by injecting unsanitized input stored in save_tmpl.cgi and rendered unescaped in list_tmpls.cgi.

Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block. The action_get_events function does not check canView on the calendar, resulting in restricted event details being disclosed.

Concrete CMS version 9.5.0 and below is vulnerable to authorization bypass in the Calendar Event Frontend Dialog, allowing cross-calendar data disclosure. A public calendar block can be used as a pivot point to access private calendar data.