GHSA-284f-f2hw-j2gx

ghsaUSosv

Server-Side Request Forgery vulnerability in concrete5

Advisory ansehen veröffentlicht 2021-10-12Lizenz: CC-BY-4.0

A Server-Side Request Forgery vulnerability was found in concrete5 < 8.5.5 that allowed a decimal notation encoded IP address to bypass the limitations in place for localhost allowing interaction with local services. Impact can vary depending on services exposed.

beschreibt (1)

Zugehörige CVEs.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2021-22958US	critical9.8	1.23% (69th)	—	2021-10-07
A Server-Side Request Forgery vulnerability was found in concrete5 < 8.5.5 that allowed a decimal notation encoded IP address to bypass the limitations in place for localhost allow…

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

https://documentation.concretecms.org/developers/introduction/version-history/855-release-notesWEB
https://github.com/concrete5/concrete5PACKAGE
https://github.com/concrete5/concrete5/pull/8826WEB
https://hackerone.com/reports/863221WEB
https://nvd.nist.gov/vuln/detail/CVE-2021-22958ADVISORY

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan