CVE-2021-22969
EPSS 0.27%Server-Side Request Forgery in Concrete CMS
發布日:2021/11/23修改日:2024/12/2
描述
Concrete CMS (formerly concrete5) versions below 8.5.7 has a SSRF mitigation bypass using DNS Rebind attack giving an attacker the ability to fetch cloud IAAS (ex AWS) IAM keys.To fix this Concrete CMS no longer allows downloads from the local network and specifies the validated IP when downloading rather than relying on DNS.Discoverer.
受影響套件(1)
- Packagist/concrete5/corefrom 0, < 8.5.7