Concrete CMS Password Change Vulnerability and Session Hardening Bypass

A vulnerability exists in Concrete CMS versions prior to 9.5.0 that allows users to change passwords without proper authorization and bypass session hardening measures. The issue arises because the user-profile edit controller transmits the entire raw POST array to the UserInfo::update() method without implementing field whitelisting. This flaw enables password changes without requiring the current password and allows registered users to disable the per-user IP pinning in the session validator, a feature designed to detect session hijacking.

Impact

Exploitation of this vulnerability allows for unauthorized password changes and the ability to disable session IP pinning, increasing the risk of session hijacking.

Remediation

Users can upgrade to Concrete CMS version 9.5.0 or later to address this vulnerability.