Concrete CMS Unauthenticated Page Metadata Disclosure Vulnerability

A vulnerability exists in Concrete CMS versions through 9.5.0, allowing unauthenticated users to access page metadata across all pages with a summary template. This exposure includes the titles, paths, descriptions, authors, and the existence of private, draft, and restricted pages. The vulnerability arises from the platform's handling of summary templates, which inadvertently leaks sensitive information.

Impact

Exploitation of this vulnerability leads to unauthorized disclosure of page metadata, including titles, paths, descriptions, authors, and the status of pages (private, draft, or restricted).

Remediation

Users can upgrade to Concrete CMS version 9.5.1 or later to address this vulnerability.