PT-2021-15298 · Concrete5 · Concrete5

Pabl00Nicarres · Published 2021-10-07 · Updated 2021-11-01 · CVE-2021-22958

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions concrete5 versions prior to 8.5.5

Description A Server-Side Request Forgery issue was found that allows a decimal notation encoded IP address to bypass localhost limitations, enabling interaction with local services. The impact varies depending on the services exposed.

Recommendations For versions prior to 8.5.5, update to version 8.5.5 or later to resolve the issue. As a temporary workaround, consider restricting access to local services to minimize the risk of exploitation.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2021-22958

GHSA-284F-F2HW-J2GX

Affected Products

Concrete5

References · 8

• https://osv.dev/vulnerability/GHSA-284f-f2hw-j2gx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22958 · Vendor Advisory
• https://documentation.concretecms.org/developers/introduction/version-history/855-release-notes · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22958 · Security Note
• https://github.com/concrete5/concrete5/pull/8826 · Note
• https://github.com/concrete5/concrete5 · Note
• https://t.me/cibsecurity/30162 · Telegram Post
• https://hackerone.com/reports/863221 · Note