Concrete CMS Cross-Site Request Forgery Vulnerability in File Approval Controller

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in Concrete CMS versions 9 prior to 9.5.0. The issue resides in the file approval controller, specifically within the 'approveVersion()' method. This vulnerability allows an attacker to trick a user with the 'edit_file_contents' permission into publishing a selected version of a file, potentially leading to unauthorized changes in file management.

Impact

Exploitation of this vulnerability could result in unauthorized file version approvals, allowing attackers to manipulate file histories and versions.

Remediation

Users can upgrade to Concrete CMS version 9.5.0 or later, where this vulnerability has been fixed.