Vulnerability · Published Apr 3, 2024 · Assigned by mitre
CVE-2021-27312
Critical 9.4
In plain English
A critical-severity server-side request forgery in the gleez/cms package (Packagist). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities).
Severity (CVSS 3.1)9.4Critical
Exploit odds (30 days)1.0%top 36.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Server Side Request Forgery (SSRF) vulnerability in Gleez Cms 1.2.0, allows remote attackers to execute arbitrary code and obtain sensitive information via modules/gleez/classes/request.php.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | gleez/cms | no fix listed | GHSA-7mxg-r76p-363g |
Affected products (as reported)
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L