Concrete CMS Cross-Site Request Forgery Vulnerability in Bulk Page Deletion Controller

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in Concrete CMS versions 9 prior to 9.5.0. The issue resides in the bulk deletion controller for pages, located at concrete/controllers/dialog/page/bulk/delete. This vulnerability allows an attacker to trick an authenticated user into performing actions without their consent.

Impact

Exploitation of this vulnerability allows for Cross-Site Request Forgery, where an attacker can manipulate an authenticated user's actions, potentially leading to unauthorized changes or deletions within the application.

Remediation

Users can upgrade to Concrete CMS version 9.5.0 or later to address this vulnerability.