Concrete CMS below 9.4.8 is vulnerable to CSRF by a Rogue Admin using the Anti-Spam Allowlist Group

Vulnerability

Overview

Concrete CMS versions prior to 9.4.8 are affected by a cross-site request forgery (CSRF) vulnerability in the Anti-Spam Allowlist Group Configuration. The flaw exists because the application saves changes to the group_id parameter before validating the CSRF token, allowing a rogue administrator to bypass the token check [1].

Attack

Vector

An attacker who is already an authenticated administrator can craft a malicious request that, when executed by another administrator (e.g., via social engineering), modifies the Anti-Spam Allowlist Group Configuration without a valid CSRF token. The attack requires low privileges (PR:L) and user interaction (UI:P), and can be performed over the network with low complexity [1].

Impact

Successful exploitation results in a security bypass with low integrity impact (VI:L). The attacker can alter the allowlist group settings, potentially weakening spam protections. There is no impact on confidentiality or availability [1].

Mitigation

The vulnerability is fixed in Concrete CMS version 9.4.8 [2]. Users are advised to upgrade to this version or later. No workarounds have been published.