Concrete CMS IDOR Vulnerability in Surveys Allowing Unauthenticated Voting on Restricted Options

A vulnerability allowing Insecure Direct Object Reference (IDOR) has been identified in Concrete CMS versions 9.5.0 and below, specifically within the surveys feature. This vulnerability arises when a site hosts both public and private surveys. An unauthenticated attacker can exploit this by voting in a private survey through the public survey's endpoint, effectively bypassing restrictions. The Concrete CMS security team assigned this vulnerability a CVSS v.4.0 score of 6.3.

Impact

Exploitation of this vulnerability allows for unauthorized voting in private surveys, undermining the integrity of the survey results.

Remediation

Users can upgrade to Concrete CMS version 9.5.1 or later, where this vulnerability has been fixed.