CVE-2025-8571

Concrete CMS 9 to 9.4.2 and versions below 8.5.21 are vulnerable to Reflected Cross-Site Scripting (XSS) in the Conversation Messages Dashboard Page. Unsanitized input could cause theft of session cookies or tokens, defacement of web content, redirection to malicious sites, and (if victim is an admin), the execution of unauthorized actions. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Fortbridge https://fortbridge.co.uk/ for performing a penetration test and vulnerability assessment on Concrete CMS and reporting this issue.

CVSS

No CVSS.

References

Link	Resource
https://documentation.concretecms.org/9-x/developers/introduction/version-history/943-release-notes
https://documentation.concretecms.org/developers/introduction/version-history/8521-release-notes
https://www.concretecms.org/download

Configurations

No configuration.

History

06 Aug 2025, 20:23

Type	Values Removed	Values Added
Summary		(es) Concrete CMS 9 a 9.4.2 y versiones anteriores a la 8.5.21 son vulnerables a ataques de Cross-Site Scripting (XSS) reflejado en la página del panel de mensajes de conversación. La entrada no depurada podría provocar el robo de cookies o tokens de sesión, la desfiguración del contenido web, la redirección a sitios maliciosos y (si la víctima es administrador), la ejecución de acciones no autorizadas. El equipo de seguridad de Concrete CMS otorgó a esta vulnerabilidad una puntuación de 4.8 en CVSS v.4.0 con el vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Gracias a Fortbridge (https://fortbridge.co.uk/) por realizar una prueba de penetración y una evaluación de vulnerabilidades en Concrete CMS e informar de este problema.

05 Aug 2025, 23:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-08-05 23:15

Updated : 2025-08-06 20:23

NVD link : CVE-2025-8571

Mitre link : CVE-2025-8571

CVE.ORG link : CVE-2025-8571

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2025-8571", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "ff5b8ace-8b95-4078-9743-eac1ca5451de", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-08-05T23:15:38.493", "references": [{"url": "https://documentation.concretecms.org/9-x/developers/introduction/version-history/943-release-notes", "source": "ff5b8ace-8b95-4078-9743-eac1ca5451de"}, {"url": "https://documentation.concretecms.org/developers/introduction/version-history/8521-release-notes", "source": "ff5b8ace-8b95-4078-9743-eac1ca5451de"}, {"url": "https://www.concretecms.org/download", "source": "ff5b8ace-8b95-4078-9743-eac1ca5451de"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "ff5b8ace-8b95-4078-9743-eac1ca5451de", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Concrete CMS 9 to 9.4.2 and versions below 8.5.21 are vulnerable to Reflected Cross-Site Scripting (XSS) in the Conversation Messages Dashboard Page.\u00a0Unsanitized input could cause theft of session cookies or tokens, defacement of web content, redirection to malicious sites, and (if victim is an admin), the execution of unauthorized actions.\u00a0The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N.\u00a0Thanks Fortbridge https://fortbridge.co.uk/ \u00a0for performing a penetration test and vulnerability assessment on Concrete CMS and reporting this issue."}, {"lang": "es", "value": "Concrete CMS 9 a 9.4.2 y versiones anteriores a la 8.5.21 son vulnerables a ataques de Cross-Site Scripting (XSS) reflejado en la p\u00e1gina del panel de mensajes de conversaci\u00f3n. La entrada no depurada podr\u00eda provocar el robo de cookies o tokens de sesi\u00f3n, la desfiguraci\u00f3n del contenido web, la redirecci\u00f3n a sitios maliciosos y (si la v\u00edctima es administrador), la ejecuci\u00f3n de acciones no autorizadas. El equipo de seguridad de Concrete CMS otorg\u00f3 a esta vulnerabilidad una puntuaci\u00f3n de 4.8 en CVSS v.4.0 con el vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Gracias a Fortbridge (https://fortbridge.co.uk/) por realizar una prueba de penetraci\u00f3n y una evaluaci\u00f3n de vulnerabilidades en Concrete CMS e informar de este problema."}], "lastModified": "2025-08-06T20:23:52.133", "sourceIdentifier": "ff5b8ace-8b95-4078-9743-eac1ca5451de"}