CVE-2023-28472 in Concrete
Summary
by MITRE • 04/28/2023
Concrete CMS (previously concrete5) before 9.2 does not have Secure and HTTP only attributes set for ccmPoll cookies.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/12/2025
Concrete CMS versions prior to 9.2 contain a significant security vulnerability related to cookie handling that exposes users to potential session hijacking and cross-site scripting attacks. The vulnerability specifically affects the ccmPoll cookies which are used for tracking user interactions and maintaining session state within the content management system. These cookies lack the Secure and HTTP only attributes that are fundamental security measures required for protecting sensitive session data. The Secure attribute ensures that cookies are only transmitted over encrypted HTTPS connections, while the HTTP only flag prevents client-side script access to the cookies, thereby mitigating cross-site scripting attacks. Without these attributes, attackers can potentially intercept cookies transmitted over unencrypted HTTP connections or exploit XSS vulnerabilities to steal session tokens and gain unauthorized access to user accounts. This vulnerability directly relates to CWE-1004 which addresses the lack of secure cookie attributes and aligns with ATT&CK technique T1546.001 for credential access through cookie manipulation. The impact extends beyond simple session theft as compromised cookies can provide attackers with persistent access to administrative functions and user data. Organizations running affected versions of Concrete CMS face increased risk of unauthorized access, data breaches, and potential lateral movement within their networks. The vulnerability represents a critical weakness in the application's session management implementation and demonstrates poor adherence to secure coding practices. Attackers can exploit this flaw by intercepting network traffic or executing malicious scripts that target the vulnerable cookie attributes. The affected versions of Concrete CMS fail to implement proper cookie security controls that are considered industry standard practices for protecting session integrity and user privacy. This vulnerability affects both authenticated and unauthenticated users who interact with the CMS, making it particularly dangerous in environments where HTTP traffic is common. The lack of secure cookie attributes creates a persistent attack surface that can be leveraged by threat actors to maintain long-term access to compromised systems. Organizations should immediately upgrade to Concrete CMS version 9.2 or later to remediate this vulnerability and ensure proper cookie security implementation. The fix involves implementing appropriate Secure and HTTP only attributes for all session cookies, including ccmPoll cookies, to prevent unauthorized access and protect against common web application attacks. Security teams should also conduct comprehensive assessments of their Concrete CMS deployments to identify any additional cookie-related vulnerabilities and implement proper network monitoring for suspicious cookie-related traffic patterns.