{"action":"Upgrade concrete5/concrete5 to 8.5.20 or later.","affected":[{"fixed":"9.4.0RC2","introduced":"9.0.0"},{"fixed":"8.5.20","introduced":"0"}],"component":"concrete5/concrete5","cve_ids":["CVE-2025-3153"],"ecosystem":"Packagist","epss":0.00191,"exploited":false,"fixed_versions":["9.4.0RC2","8.5.20"],"ghsa_id":"GHSA-cmm4-p9v2-q453","id":"tcs_01M5KF131ASZPBP1KWAB4R7Y19","modified_at":"2025-04-04T14:57:08.981482Z","published_at":"2025-04-03T04:41:19Z","references":["https://osv.dev/vulnerability/GHSA-cmm4-p9v2-q453","https://nvd.nist.gov/vuln/detail/CVE-2025-3153","https://github.com/concretecms/concretecms/pull/12511","https://github.com/concretecms/concretecms/pull/12512","https://documentation.concretecms.org/9-x/developers/introduction/version-history/940-release-notes","https://github.com/concretecms/concretecms","https://github.com/concretecms/concretecms/releases/tag/8.5.20"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-cmm4-p9v2-q453","url":"https://osv.dev/vulnerability/GHSA-cmm4-p9v2-q453"},{"source":"nvd","source_id":"CVE-2025-3153","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3153"}],"summary":"Concrete CMS Vulnerable to Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS)"}