Concrete CMS Cross-Site Request Forgery Vulnerability in Anti-Spam Allowlist Group Configuration

A cross-site request forgery (CSRF) vulnerability has been identified in Concrete CMS versions prior to 9.4.8. This issue allows a rogue administrator to manipulate the Anti-Spam Allowlist Group Configuration by using the group_id parameter. The vulnerability arises because changes are saved before the CSRF token is validated, leading to a security bypass.

Impact

Exploitation of this vulnerability could result in unauthorized changes to group configurations, bypassing CSRF protections.

Remediation

Users can upgrade to Concrete CMS version 9.4.8 or later to address this vulnerability.