Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1ncXB3LTlxNTQtOXgyOM0XkA
Server-Side Request Forgery in Concrete CMS
Concrete CMS (formerly concrete5) versions 8.5.6 and below and version 9.0.0 allow local IP importing causing the system to be vulnerable to SSRF attacks on the private LAN to servers by reading files from the local LAN. An attacker can pivot in the private LAN and exploit local network appsandb.
Permalink: https://github.com/advisories/GHSA-gqpw-9q54-9x28JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ncXB3LTlxNTQtOXgyOM0XkA
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 2 years ago
Updated: about 1 year ago
Identifiers: GHSA-gqpw-9q54-9x28, CVE-2021-22970
References:
- https://nvd.nist.gov/vuln/detail/CVE-2021-22970
- https://hackerone.com/reports/1364797
- https://documentation.concretecms.org/developers/introduction/version-history/857-release-notes
- https://documentation.concretecms.org/developers/introduction/version-history/901-release-notes
- https://github.com/advisories/GHSA-gqpw-9q54-9x28
Affected Packages
packagist:concrete5/core
Dependent packages: 33Dependent repositories: 56
Downloads: 114,120 total
Affected Version Ranges: < 8.5.7
Fixed in: 8.5.7
All affected versions: 8.2.0, 8.2.1, 8.3.0, 8.3.1, 8.3.2, 8.4.0, 8.4.1, 8.4.2, 8.4.3, 8.4.4, 8.4.5, 8.5.0, 8.5.1, 8.5.2, 8.5.3, 8.5.4, 8.5.5, 8.5.6
All unaffected versions: 8.5.7, 8.5.8, 8.5.9, 8.5.10, 8.5.11, 8.5.12, 8.5.13, 8.5.14, 8.5.15, 9.0.0, 9.0.1, 9.0.2, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.2.4, 9.2.5, 9.2.6, 9.2.7, 9.2.8