Concrete CMS is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialog

NVD Description

Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialog.  This can cause Cross-entity state tampering with view-only permission on one entry. To be affected, a website has to be using express and relying on express entity ordering. Thanks Winston Crooker for reporting.

Affected Packages (1)

Public Exploits & PoCs1 found