CRITICAL9.1

GHSA-gc45-j3m5-8qfq

Server-Side Request Forgery in Feehi CMS

Details

Feehi CMS 2.1.1 is affected by a Server-side request forgery (SSRF) vulnerability. When the user modifies the HTTP Referer header to any url, the server can make a request to it.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/feehi/cms

Introduced in: 0

No fixed version published yet for feehi/cms (composer). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2021-30108[ADVISORY]
https://github.com/liufee/cms/issues/57[WEB]
https://github.com/liufee/cms/issues/57#issuecomment-1230070460[WEB]
https://github.com/liufee/cms/commit/d45cb9cb26d6f5ef491fa2c7d87ac7f26091bd7c[WEB]