Concrete CMS Insecure Direct Object Reference Vulnerability in Express Entry Detail Block

A vulnerability allowing Insecure Direct Object Reference (IDOR) has been identified in Concrete CMS versions through 9.5.0. This vulnerability exists in the Express Entry Detail block, specifically through the exEntryID parameter, and leads to unauthorized access to all submissions of Express forms.

Impact

Exploitation of this vulnerability allows unauthorized users to access all submissions of Express forms, potentially leading to data exposure or misuse.

Remediation

Users can upgrade to Concrete CMS version 9.5.1 or later to address this vulnerability.