CVE-2020-14961

Concrete5 before 8.5.3 does not constrain the sort direction to a valid asc or desc value.