CVE-2023-28473: 
PHP vulnerability analysis and mitigation

Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to possible authentication bypass in the jobs section. The vulnerability was discovered and disclosed in April 2023 (Concrete Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 3.3 LOW with vector string CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L. The vulnerability is related to improper authentication in the jobs section of the CMS (NVD).

The vulnerability could allow an attacker to bypass authentication controls in the jobs section, potentially leading to unauthorized access and modifications to job-related functionality. The impact is considered low as it requires high privileges and has limited impact on integrity and availability (Concrete Advisory).

The vulnerability requires high attack complexity and high privileges to exploit, making it relatively difficult to take advantage of. The Concrete CMS Security team scored this with a CVSS v3.1 vector indicating network attack vector with high complexity and high privilege requirements (Concrete Advisory).

The vulnerability has been fixed in Concrete CMS version 9.2. Users are advised to upgrade to version 9.2 or later to address this security issue. The fix has also been backported to version 8.5.13 for users on the 8.5.x branch (Security Blog).