GitHub Advisoryadvisory · Packagist

GHSA-gqpw-9q54-9x28 Server-Side Request Forgery in Concrete CMS

MEDIUM Published 2021-11-23 Modified 2021-11-22 Official page ↗
Aliases
CVE-2021-22970
Ecosystem
Packagist
Packages
concrete5/core
Severity
Moderate
Weaknesses
CWE-918
Reviewed
2021-11-22

Affected packages

• Packagist concrete5/core: < 8.5.7 → fixed in 8.5.7

Description

Concrete CMS (formerly concrete5) versions 8.5.6 and below and version 9.0.0 allow local IP importing causing the system to be vulnerable to SSRF attacks on the private LAN to servers by reading files from the local LAN. An attacker can pivot in the private LAN and exploit local network appsandb.

Related

Alias · CVE (1)

  • CVE-2021-22970 Concrete CMS (formerly concrete5) versions 8.5.6 and below and version 9.0.0 allow local IP importing causing the system to be vulnerable… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References