CVE-2021-22970
Description
Concrete CMS (formerly concrete5) versions 8.5.6 and below and version 9.0.0 allow local IP importing causing the system to be vulnerable toa. SSRF attacks on the private LAN servers by reading files from the local LAN. An attacker can pivot in the private LAN and exploit local network appsandb. SSRF Mitigation Bypass through DNS RebindingConcrete CMS security team gave this a CVSS score of 3.5 AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:NConcrete CMS is maintaining Concrete version 8.5.x until 1 May 2022 for security fixes.This CVE is shared with HackerOne Reports https://hackerone.com/reports/1364797 and https://hackerone.com/reports/1360016Reporters: Adrian Tiron from FORTBRIDGE (https://www.fortbridge.co.uk/ ) and Bipul Jaiswal
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
concrete5/corePackagist | < 8.5.7 | 8.5.7 |
Affected products
4- Concrete CMS/Concrete CMSdescription
Patches
Vulnerability mechanics
References
5- documentation.concretecms.org/developers/introduction/version-history/857-release-notesnvdRelease NotesVendor AdvisoryWEB
- documentation.concretecms.org/developers/introduction/version-history/901-release-notesnvdRelease NotesVendor AdvisoryWEB
- github.com/advisories/GHSA-gqpw-9q54-9x28ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2021-22970ghsaADVISORY
- hackerone.com/reports/1364797nvdPermissions RequiredWEB
News mentions
0No linked articles in our index yet.