CVE-2021-40109
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A SSRF issue was discovered in Concrete CMS through 8.5.5. Users can access forbidden files on their local network. A user with permissions to upload files from external sites can upload a URL that redirects to an internal resource of any file type. The redirect is followed and loads the contents of the file from the redirected-to server. Files of disallowed types can be uploaded.
Se ha detectado un problema de tipo SSRF en Concrete CMS versiones hasta 8.5.5. Unos usuarios pueden acceder a archivos prohibidos en su red local. Un usuario con permisos para subir archivos desde sitios externos puede subir una URL que redirija a un recurso interno de cualquier tipo de archivo. La redirección es seguida y carga el contenido del archivo desde el servidor al que se redirige. Los archivos de tipos no permitidos pueden ser cargados
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-08-25 CVE Reserved
- 2021-09-27 CVE Published
- 2023-04-20 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-918: Server-Side Request Forgery (SSRF)
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://documentation.concretecms.org/developers/introduction/version-history/856-release-notes | 2021-09-30 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Concretecms Search vendor "Concretecms" | Concrete Cms Search vendor "Concretecms" for product "Concrete Cms" | < 8.5.6 Search vendor "Concretecms" for product "Concrete Cms" and version " < 8.5.6" | - |
Affected
| ||||||