CyberRota Analysis
AI-GeneratedConcrete CMS versions prior to 9.5.3 are vulnerable due to improper access controls that allow unauthenticated users to retrieve sensitive configuration values, such as Google Maps API keys, from restricted sub-blocks within public pages. This exposure can lead to unauthorized access to critical site configurations and potential misuse of the API keys. Organizations using affected versions of Concrete CMS should prioritize addressing this vulnerability to mitigate the risk of data leakage and unauthorized access.
Original NVD Description
Concrete CMS below 9.5.3 registered view assets for every sub-block of a Stack, Container, or layout area without checking whether the requesting user could view that sub-block. An unauthenticated visitor could recover configuration values emitted by a restricted sub-block's asset registration — such as a site's configured Google Maps API key — from any public page embedding an affected Stack, Container, or layout area, despite the block-level permission restriction. Any sub-block type whose asset or header hooks output configuration values is affected. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.