CVE-2025-3153

Summary

CVE-2025-3153 is a vulnerability affecting Concrete CMS versions 9 below 9.4.0RC2 and versions below 8.5.20. The issue lies in the Address attribute, where addresses are not adequately sanitized when specifying a country. Attackers with the ability to fill in this attribute can perform both Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) attacks. The extent of the data leakage and modification depends on the level of access of the attacker and mitigating controls. The Concrete CMS dashboard page could also be made unavailable. The vulnerability was assigned a CVSS v.4.0 score of 5.1 with a low attack complexity and impact. This issue only affects newly uploaded data in Concrete CMS 9.4.0RC2, so it's crucial to search the database for existing entries potentially exploited under earlier versions.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.