CVE-2021-22958: SSRF
Published Oct 7, 2021
·Updated
A Server-Side Request Forgery vulnerability was found in concrete5 < 8.5.5 that allowed a decimal notation encoded IP address to bypass the limitations in place for localhost allowing interaction with local services. Impact can vary depending on services exposed.CVSSv2.0 AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
Affected Software
1 affected component
ConcreteCMS Concrete CMS<8.5.5
Event History
Oct 7, 2021
CVE Published
via MITRE·01:35 PM
Data Sourced
via MITRE·01:35 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-22958.
2
What is the severity of CVE-2021-22958?
The severity of CVE-2021-22958 is critical (9.8).
3
What is the impact of CVE-2021-22958?
The impact of CVE-2021-22958 can vary depending on the services exposed.
4
What is the affected software for CVE-2021-22958?
The affected software for CVE-2021-22958 is concrete5 < 8.5.5.
5
How can I fix CVE-2021-22958?
To fix CVE-2021-22958, update concrete5 to version 8.5.5 or newer.