GHSA-284f-f2hw-j2gx

ghsaUSosv

Server-Side Request Forgery vulnerability in concrete5

view advisory published 2021-10-12Licence: CC-BY-4.0

A Server-Side Request Forgery vulnerability was found in concrete5 < 8.5.5 that allowed a decimal notation encoded IP address to bypass the limitations in place for localhost allowing interaction with local services. Impact can vary depending on services exposed.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-22958US	critical9.8	1.23% (69th)	—	2021-10-07
A Server-Side Request Forgery vulnerability was found in concrete5 < 8.5.5 that allowed a decimal notation encoded IP address to bypass the limitations in place for localhost allow…

references

External citations — patches, advisories, analysis.

https://documentation.concretecms.org/developers/introduction/version-history/855-release-notesWEB
https://github.com/concrete5/concrete5PACKAGE
https://github.com/concrete5/concrete5/pull/8826WEB
https://hackerone.com/reports/863221WEB
https://nvd.nist.gov/vuln/detail/CVE-2021-22958ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan