Concrete CMS IDOR Vulnerability in Conversations Endpoint Allowing Unauthenticated Message Enumeration

An Insecure Direct Object Reference (IDOR) vulnerability has been identified in Concrete CMS versions 9.5.0 and prior. The issue resides in the '/ccm/frontend/conversations/message_page' endpoint, which exposes the full content of any conversation message to unauthenticated users. This vulnerability allows for the enumeration of all conversation messages, including those from restricted pages, member-only areas, and the moderation queue. Additionally, file attachments are also disclosed through their download URLs.

Impact

Exploitation of this vulnerability could lead to unauthorized access to private conversation messages and associated file attachments, including those from restricted pages and the moderation queue.

Remediation

Users can upgrade to Concrete CMS version 9.5.1 or later to address this vulnerability.