Read the docs
TI-2025-02754 Aliases CVE-2025-3153GHSA-cmm4-p9v2-q453

Concrete CMS version 9 below 9.4.0RC2 and versions below 8.5.20 - CSRF and XSS in Concrete CMS Custom Address attribute

Priority LOW 23CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Tampering, Cross-site scripting
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-352 and CWE-79.

Summary

Concrete CMS version 9 below 9.4.0RC2 and versions below 8.5.20 are vulnerable to CSRF and XSS in the Concrete CMS Address attribute because addresses are not properly sanitized in the output when a country is not specified.  Attackers are limited to individuals whom a site administrator has granted the ability to fill in an address attribute. It is possible for the attacker to glean limited information from the site but amount and type is restricted by mitigating controls and the level of access of the attacker. Limited data modification is possible. The dashboard page itself could be rendered unavailable. The fix only sanitizes new data uploaded post update to Concrete CMS 9.4.0RC2. Existing database entries added before the update will still be “live” if there were successful exploits added under previous versions; a database search is recommended. The Concrete CMS security team gave this vulnerability CVSS v.4.0 score of 5.1 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L Thanks Myq Larson for reporting.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00195 9th percentileScored 2026-11-07
Fix Fixed concrete5/concrete5 (Packagist): 9.4.0RC2, 8.5.20

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—concrete5/concrete5 (Packagist)9.0.0 to before 9.4.0RC29.4.0RC2Patch availableGHSA-cmm4-p9v2-q453
—concrete5/concrete5 (Packagist)before 8.5.208.5.20Patch availableGHSA-cmm4-p9v2-q453
  • concrete5/concrete5 (Packagist) Vendor— Affected 9.0.0 to before 9.4.0RC2 Fixed in 9.4.0RC2 Patch available GHSA-cmm4-p9v2-q453
  • concrete5/concrete5 (Packagist) Vendor— Affected before 8.5.20 Fixed in 8.5.20 Patch available GHSA-cmm4-p9v2-q453

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*before 8.5.20; 9.0 to before 9.4.0VulnerableConcrete CMS
cpe:2.3:a:concretecms:concrete_cms:9.4.0:rc1:*:*:*:*:*:*9.4.0 rc1VulnerableConcrete CMS
  • cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:* Versions before 8.5.20; 9.0 to before 9.4.0 Vulnerable ·Concrete CMS
  • cpe:2.3:a:concretecms:concrete_cms:9.4.0:rc1:*:*:*:*:*:* Versions 9.4.0 rc1 Vulnerable ·Concrete CMS

Remediation

  • Fix · GHSA-cmm4-p9v2-q453 concrete5/concrete5 (Packagist) Fixed in 9.4.0RC2 Advisory →
  • Fix · GHSA-cmm4-p9v2-q453 concrete5/concrete5 (Packagist) Fixed in 8.5.20 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-3153
  2. 2026-10-03 Alias added: GHSA-cmm4-p9v2-q453

References

Patch 2

Advisory 1

Other 3

  • TI-2026-23602 ConcreteCMS v9.4.7 contains a Denial of Service (DoS) vulnerability in the File Manager… CVSS 3.1MEDIUM 6.5
  • TI-2023-23992 A Cross Site Scripting (XSS) vulnerability in Concrete CMS from versions 9.2.0 to 9.2.2… CVSS 3.1MEDIUM 5.4
  • TI-2023-26495 Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because… CVSS 3.1CRITICAL 9.8
  • TI-2026-14907 Missing authorization in Concrete CMS CVSS 4.0HIGH 8.7
  • TI-2022-06200 Cleartext transmission of sensitive information in https://github.com/concrete5/concrete5 CVSS 3.1CRITICAL 9.8
  • TI-2021-17294 An issue was discovered in Concrete CMS through 8.5.5. CVSS 3.1CRITICAL 9.8
See all 197 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences