GHSA-gqpw-9q54-9x28
Suggest an improvement- Source
- https://github.com/advisories/GHSA-gqpw-9q54-9x28
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/11/GHSA-gqpw-9q54-9x28/GHSA-gqpw-9q54-9x28.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-gqpw-9q54-9x28
- Aliases
-
- CVE-2021-22970
- Published
- 2021-11-23T18:18:43Z
- Modified
- 2024-12-02T05:45:56.229865Z
- Summary
- Server-Side Request Forgery in Concrete CMS
- Details
-
Concrete CMS (formerly concrete5) versions 8.5.6 and below and version 9.0.0 allow local IP importing causing the system to be vulnerable to SSRF attacks on the private LAN to servers by reading files from the local LAN. An attacker can pivot in the private LAN and exploit local network appsandb.
- Database specific
{ "nvd_published_at": "2021-11-19T19:15:00Z", "cwe_ids": [ "CWE-918" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2021-11-22T18:24:09Z" }- References
Affected packages
Packagist / concrete5/core
Package
- Name
- concrete5/core
- Purl
- pkg:composer/concrete5/core