CVE-2021-22950

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 8.5.6

Description The issue allows attachments to comments in the conversation section to be deleted due to a CSFR vulnerability. Credit for discovery is given to the Solar Security Research Team.

Recommendations For versions prior to 8.5.6, update to version 8.5.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the conversation section to minimize the risk of exploitation.