Cross-Site Request Forgery and Cross-Site Scripting in Concrete CMS by Concrete

CVE-2025-3153

What is CVE-2025-3153?

Concrete CMS versions prior to 9.4.0RC2 and 8.5.20 exhibit vulnerabilities to Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS) due to improper sanitization of address outputs when the country field is unspecified. Limited access is granted to attackers who control users permitted to fill the address attribute, enabling them to extract data and potentially craft exploits. Existing entries in the database may remain vulnerable if they were introduced before the update, necessitating thorough database scrutiny for security. Mitigation steps are essential to secure user data and maintain the integrity of the CMS environment.

References