Detections
Analytics

SCA: security update for concrete5/concrete5 (GHSA-cmm4-p9v2-q453)

medium Tenable Cloud Security Plugin ID 424766

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Concrete CMS version 9 below 9.4.0RC2 and versions below 8.5.20 are vulnerable to CSRF and XSS in the
 Concrete CMS Address attribute because addresses are not properly sanitized in the output when a country
 is not specified. Attackers are limited to individuals whom a site administrator has granted the ability
 to fill in an address attribute. It is possible for the attacker to glean limited information from the
 site but amount and type is restricted by mitigating controls and the level of access of the attacker.
 Limited data modification is possible. The dashboard page itself could be rendered unavailable. The fix
 only sanitizes new data uploaded post update to Concrete CMS 9.4.0RC2. Existing database entries added
 before the update will still be “live” if there were successful exploits added under previous versions; a
 database search is recommended. The Concrete CMS security team gave this vulnerability CVSS v.4.0 score of
 5.1 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L Thanks Myq Larson for
 reporting. (CVE-2025-3153)

See Also

https://github.com/advisories/GHSA-cmm4-p9v2-q453

Plugin Details

Severity: Medium

ID: 424766

Version: Revision 1.9

Type: Local

Family: SCA Checks

Published: 4/4/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.1

Percentile: 49.84

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 4.8

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS Score Source: CVE-2025-3153

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 5.1

Threat Score: 1.2

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 4/3/2025

Vulnerability Publication Date: 4/3/2025

Reference Information

CVE: CVE-2025-3153

cwe: CWE-79