GitHub Advisoryadvisory · Packagist

GHSA-284f-f2hw-j2gx Server-Side Request Forgery vulnerability in concrete5

HIGH Published 2021-10-12 Modified 2021-10-18 Official page ↗
Aliases
CVE-2021-22958
Ecosystem
Packagist
Packages
concrete5/concrete5
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Weaknesses
CWE-918
Reviewed
2021-10-08

Affected packages

• Packagist concrete5/concrete5: < 8.5.5 → fixed in 8.5.5

Description

A Server-Side Request Forgery vulnerability was found in concrete5 < 8.5.5 that allowed a decimal notation encoded IP address to bypass the limitations in place for localhost allowing interaction with local services. Impact can vary depending on services exposed.

Related

Alias · CVE (1)

  • CVE-2021-22958 A Server-Side Request Forgery vulnerability was found in concrete5 < 8.5.5 that allowed a decimal notation encoded IP address to bypass the… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References