CVE-2025-3153: Concrete CMS Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS) Vulnerability
Summary
CVE-2025-3153: Concrete CMS Vulnerable to Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS). Affects concrete5/concrete5 across 2 version ranges.
< 8.5.20
>= 9.0.0, < 9.4.0RC2
Fixed in 8.5.20 or 9.4.0RC2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Concrete CMS is an open-source content management system that allows users to build and manage websites with ease. It provides a user-friendly interface and a variety of features, including customizable themes, user permissions, and an extensive add-on marketplace. However, certain versions of Concrete CMS are vulnerable to Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS) attacks due to improper sanitization of address attributes, particularly when a country is not specified.
Vulnerability Detail
Concrete CMS versions 9 below 9.4.0RC2 and versions below 8.5.20 are susceptible to CSRF and XSS vulnerabilities. This arises from the failure to properly sanitize output related to address attributes. Attackers can exploit this vulnerability if they have been granted permission by a site administrator to fill in address attributes. The potential consequences include unauthorized data modification, limited information disclosure, and the possibility of rendering the dashboard page unavailable. Existing database entries that were exploited prior to the update remain vulnerable, necessitating a thorough database search.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 8.5.208.5.20composer require concrete5/concrete5:8.5.20 -
>= 9.0.0, < 9.4.0RC29.4.0RC2composer require concrete5/concrete5:9.4.0RC2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, restrict access to the address attribute functionality to trusted users only. Additionally, conduct a database search for any potentially malicious entries that may have been added prior to the update.
Conclusion
Concrete CMS has a significant vulnerability related to CSRF and XSS that affects specific versions. It is crucial for users to update to the latest patched versions to mitigate risks. Additionally, users should consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for concrete5/concrete5 →
FAQ
The vulnerabilities can lead to unauthorized data modification, limited information disclosure, and potential denial of service for the dashboard page.
You can use Vulert's playground at Vulert Scanner to check for vulnerabilities in your application without needing to sign up.
Concrete CMS versions 9 below 9.4.0RC2 and versions below 8.5.20 are affected by this vulnerability.
If immediate updates are not possible, restrict access to the affected features and conduct a thorough database review for any malicious entries.
The vulnerability was reported by Myq Larson to the Concrete CMS security team.
References
Related vulnerabilities
Recent vulnerabilities recorded for concrete5/concrete5.
