PT-2025-6250 · Concorde · Concorde

Nexryai · Published 2025-02-11 · Updated 2025-02-11 · CVE-2025-24900

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Concorde versions prior to 12.25Q1.1

Description: The issue arises from a lack of CSRF countermeasures and improper settings of cookies for MediaProxy authentication, allowing an attacker to bypass MediaProxy authentication. This enables the attacker to load any image without restrictions under certain circumstances. In versions prior to 12.24Q2.3, the vulnerability also bypasses bull-board authentication, potentially leading to significant impacts on availability and integrity.

Recommendations: For versions prior to 12.25Q1.1, update to version 12.25Q1.1 to fix the security flaw. As a temporary workaround, consider restricting access to MediaProxy authentication and the job queue management page (bull-board) until the update is applied. No other effective workarounds are available apart from updating to the patched version.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-24900

GHSA-5HGQ-9VW8-7V87

Affected Products

Concorde

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24900.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-24900 · Security Note
• https://osv.dev/vulnerability/CVE-2025-24900 · Vendor Advisory
• https://github.com/nexryai/concorde/commit/f3f54bde6a37ad310f83ae46de54a286c4b74059 · Note
• https://github.com/nexryai/concorde/security/advisories/GHSA-5hgq-9vw8-7v87 · Note
• https://github.com/nexryai/concorde/commit/2309b4a292828ddba4d57cf0e914bc433095871d · Note
• https://twitter.com/CveFindCom/status/1889344501895868565 · Twitter Post
• https://twitter.com/CVEnew/status/1889341251239203229 · Twitter Post