Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 does not issue a new session ID upon successful OAuth authentication. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Concrete_cms | Concretecms | * | 8.5.10 (excluding) |
| Concrete_cms | Concretecms | 9.0.0 (including) | 9.1.2 (including) |
Such a scenario is commonly observed when: