CyberRota Analysis
AI-GeneratedThe block-create endpoint in Concrete CMS versions 9.2.0 to 9.5.2 is vulnerable due to a failure to validate submitted data against the block type controller, allowing authenticated users with block-add permissions to reference files that should be restricted by the file-manager's visibility settings. This can lead to unauthorized disclosure of file URLs and previews, potentially exposing sensitive information to both editors and visitors. Organizations using affected versions of Concrete CMS should prioritize patching this vulnerability to mitigate the risk of unauthorized file access.
Original NVD Description
Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate() method on submitted data, which, for file-referencing blocks such as hero_image and gallery, is where the referenced file is authorized against the user's file-manager visibility. As a result, an authenticated user holding the block-add scope could store, and cause the page to render, a reference to a file that the file-manager authorization policy would otherwise reject, disclosing that file's URL and preview to the editor and to visitors of the affected page. Under public file storage, the URL and thumbnail are exposed directly; under private storage, the disclosure is limited by the permission-checked download URL. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.1 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N. Thanks riodrwn for reporting.