Vulnerability · Published Nov 19, 2021 · Assigned by hackerone
CVE-2021-22970
High 7.5
In plain English
A high-severity server-side request forgery in https://github.com/concrete5/concrete5. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Concrete CMS (formerly concrete5) versions 8.5.6 and below and version 9.0.0 allow local IP importing causing the system to be vulnerable toa. SSRF attacks on the private LAN servers by reading files from the local LAN. An attacker can pivot in the private LAN and exploit local network appsandb. SSRF Mitigation Bypass through DNS RebindingConcrete CMS security team gave this a CVSS score of 3.5 AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:NConcrete CMS is maintaining Concrete version 8.5.x until 1 May 2022 for security fixes.This CVE is shared with HackerOne Reports https://hackerone.com/reports/1364797 and https://hackerone.com/reports/1360016Reporters: Adrian Tiron from FORTBRIDGE (https://www.fortbridge.co.uk/ ) and Bipul Jaiswal
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | concrete5/core | 8.5.7 | GHSA-gqpw-9q54-9x28 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | https://github.com/concrete5/concrete5 | Affected versions Concrete CMS (formerly concrete5) versions below 8.5.6 and 9.0.0. Fixed versions 9.0.1 and 8.5.7 |
Weakness: CWE-918