CVE-2023-28472: 
PHP vulnerability analysis and mitigation

Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 contains a security vulnerability related to cookie attributes. The vulnerability (CVE-2023-28472) was disclosed on April 20, 2023, affecting the ccmPoll cookies which did not have Secure and HTTP only attributes set (Concrete Advisory).

The vulnerability affects the Survey Block Controller in Concrete CMS where ccmPoll cookies lack proper security attributes. The CVSS v3.1 base score is 3.4 (LOW) with a vector of AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N, indicating network accessibility, high attack complexity, no privileges required, user interaction required, changed scope, and low confidentiality impact (Concrete Advisory).

The vulnerability could potentially expose cookie data to unauthorized access due to the missing Secure and HTTP only attributes. The impact is primarily limited to confidentiality concerns, with no direct impact on integrity or availability of the system (Concrete Advisory).

The vulnerability requires high attack complexity and user interaction to exploit. While it is network accessible, the actual exploitation difficulty is considered high due to these requirements (Concrete Advisory).

The vulnerability has been fixed in Concrete CMS version 9.2. The fix includes adding support for the concrete.session.cookie.cookie_secure value to the ccmPoll cookie, which developers can set to true if they want to use secure cookies. For version 8.5, the fix was backported to version 8.5.13 (Security Blog).