HIGH8.2

GHSA-284f-f2hw-j2gx

Server-Side Request Forgery vulnerability in concrete5

Quick fix

GHSA-284f-f2hw-j2gx — concrete5/concrete5: upgrade to the fixed version with the command below.

composer require concrete5/concrete5:^8.5.5

Details

A Server-Side Request Forgery vulnerability was found in concrete5 < 8.5.5 that allowed a decimal notation encoded IP address to bypass the limitations in place for localhost allowing interaction with local services. Impact can vary depending on services exposed.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/concrete5/concrete5

Introduced in: 0Fixed in: 8.5.5

Fixcomposer require concrete5/concrete5:^8.5.5

References

https://nvd.nist.gov/vuln/detail/CVE-2021-22958[ADVISORY]
https://github.com/concrete5/concrete5/pull/8826[WEB]
https://hackerone.com/reports/863221[WEB]
https://documentation.concretecms.org/developers/introduction/version-history/855-release-notes[WEB]
https://github.com/concrete5/concrete5[PACKAGE]