CVE-2025-3153: Concrete CMS version 9 below 9.4.0RC2 and versions below 8.5.20 - CSRF and XSS in Concrete CMS Custom Address attributeC
First published: Thu Apr 03 2025(Updated: )
Concrete CMS version 9 below 9.4.0RC2 and versions below 8.5.20 are vulnerable to CSRF and XSS in the Concrete CMS Address attribute because addresses are not properly sanitized in the output when a country is not specified. Attackers are limited to individuals whom a site administrator has granted the ability to fill in an address attribute. It is possible for the attacker to glean limited information from the site but amount and type is restricted by mitigating controls and the level of access of the attacker. Limited data modification is possible. The dashboard page itself could be rendered unavailable. The fix only sanitizes new data uploaded post update to Concrete CMS 9.4.0RC2. Existing database entries added before the update will still be “live” if there were successful exploits added under previous versions; a database search is recommended. The Concrete CMS security team gave this vulnerability CVSS v.4.0 score of 5.1 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L Thanks Myq Larson for reporting.
Credit: ff5b8ace-8b95-4078-9743-eac1ca5451de
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Concrete CMS | <9.4.0RC2<8.5.20 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-3153?
CVE-2025-3153 is rated as a medium severity vulnerability due to its potential for CSRF and XSS attacks.
How do I fix CVE-2025-3153?
To fix CVE-2025-3153, upgrade your Concrete CMS installation to version 9.4.0RC2 or 8.5.20 or later.
Who is affected by CVE-2025-3153?
CVE-2025-3153 affects users of Concrete CMS versions earlier than 9.4.0RC2 and 8.5.20.
What type of vulnerabilities does CVE-2025-3153 involve?
CVE-2025-3153 involves Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS) vulnerabilities.
In what scenarios can CVE-2025-3153 be exploited?
CVE-2025-3153 can be exploited when addresses are improperly sanitized in cases where a country is not specified.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/weakness
- agent/title
- agent/first-publish-date
- agent/description
- agent/type
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/severity
- agent/last-modified-date
- agent/author
- agent/source
- agent/tags
- agent/event
- vendor/concrete cms
- canonical/concrete cms