GHSA-gqpw-9q54-9x28
Server-Side Request Forgery in Concrete CMS
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | concrete5/core | < 8.5.7 | 8.5.7 |
Details
As written in the advisory (Markdown source, shown as plain text).
Concrete CMS (formerly concrete5) versions 8.5.6 and below and version 9.0.0 allow local IP importing causing the system to be vulnerable to SSRF attacks on the private LAN to servers by reading files from the local LAN. An attacker can pivot in the private LAN and exploit local network appsandb.
References
External links from the advisory. They lead to third-party sites.