GHSA-GQPW-9Q54-9X28中危已审查

Server-Side Request Forgery in Concrete CMS

OSV 1.4.0 · github-reviewed · 修改于 2021-11-23 02:24

发布时间

2021-11-24 02:18

GitHub 审查时间

2021-11-23 02:24

NVD 发布时间

2021-11-20 03:15

源文件

advisories/github-reviewed/2021/11/GHSA-gqpw-9q54-9x28/GHSA-gqpw-9q54-9x28.json

公告说明

Concrete CMS (formerly concrete5) versions 8.5.6 and below and version 9.0.0 allow local IP importing causing the system to be vulnerable to SSRF attacks on the private LAN to servers by reading files from the local LAN. An attacker can pivot in the private LAN and exploit local network appsandb.

受影响的软件包

Packagist

concrete5/core

ECOSYSTEM

引入0修复8.5.7

标识信息

别名 / CVE

CVE-2021-22970

CWE

CWE-918

软件生态

Packagist

扩展资料

暂无扩展资料。

CVSS 评分

没有 CVSS 数据。

原始 OSV JSON

{
  "id": "GHSA-gqpw-9q54-9x28",
  "aliases": [
    "CVE-2021-22970"
  ],
  "details": "Concrete CMS (formerly concrete5) versions 8.5.6 and below and version 9.0.0 allow local IP importing causing the system to be vulnerable to SSRF attacks on the private LAN to servers by reading files from the local LAN. An attacker can pivot in the private LAN and exploit local network appsandb.",
  "summary": "Server-Side Request Forgery in Concrete CMS",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.5.7"
            }
          ]
        }
      ],
      "package": {
        "name": "concrete5/core",
        "ecosystem": "Packagist"
      }
    }
  ],
  "modified": "2021-11-22T18:24:09Z",
  "severity": [],
  "published": "2021-11-23T18:18:43Z",
  "references": [
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22970",
      "type": "ADVISORY"
    },
    {
      "url": "https://hackerone.com/reports/1364797",
      "type": "WEB"
    },
    {
      "url": "https://documentation.concretecms.org/developers/introduction/version-history/857-release-notes",
      "type": "WEB"
    },
    {
      "url": "https://documentation.concretecms.org/developers/introduction/version-history/901-release-notes",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": "2021-11-19T19:15:00Z",
    "github_reviewed_at": "2021-11-22T18:24:09Z"
  }
}