GHSA-284f-f2hw-j2gx
Server-Side Request Forgery vulnerability in concrete5
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | concrete5/concrete5 | < 8.5.5 | 8.5.5 |
Details
As written in the advisory (Markdown source, shown as plain text).
A Server-Side Request Forgery vulnerability was found in concrete5 < 8.5.5 that allowed a decimal notation encoded IP address to bypass the limitations in place for localhost allowing interaction with local services. Impact can vary depending on services exposed.
References
External links from the advisory. They lead to third-party sites.