GHSA-vx6p-q4gj-x6xx CVE-2021-25972
Camaleon CMS vulnerable to Server-Side Request Forgery
- Severity
- 4.9 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.99%
- Chance of exploitation in the next 30 days. Higher than 62.40% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-918 Server-Side Request Forgery (SSRF)
- Fix
2.6.0.1- Upgrade camaleon_cms to this version or later
Description
In Camaleon CMS, versions 2.1.2.0 through 2.6.0, are vulnerable to Server-Side Request Forgery (SSRF) in the media upload feature, which allows admin users to fetch media files from external URLs but fails to validate URLs referencing to localhost or other internal servers. This allows attackers to read files stored in the internal server.
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| camaleon_cms | >= 2.1.2.0, < 2.6.0.1 |
2.6.0.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
camaleon_cms RubyGems → 2.6.0.1
- bundler
bundle update camaleon_cms # Gemfile: gem "camaleon_cms", ">= 2.6.0.1"
Severity breakdown
CVSS 3.1 4.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- High
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-918: Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-jw5g-f64p-6x78 Camaleon CMS vulnerable to Path Traversal through AWS S3 uploader implementation | Medium | Also affects camaleon_cms |
| GHSA-rp28-mvq3-wf8j Camaleon CMS Vulnerable to Privilege Escalation through a Mass Assignment | Critical | Also affects camaleon_cms |
| GHSA-hhxg-rvc9-8726 camaleon_cms affected by cross site scripting | Medium | Also affects camaleon_cms |
| GHSA-75j2-9gmc-m855 Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184) | Medium | Also affects camaleon_cms |
| GHSA-8fx8-3rg2-79xw Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184) | Medium | Also affects camaleon_cms |
| GHSA-7x4w-cj9r-h4v9 Camaleon CMS vulnerable to remote code execution through code injection (GHSL-2024-185) | High | Also affects camaleon_cms |
| GHSA-r9cr-qmfw-pmrc Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184) | Medium | Also affects camaleon_cms |
| GHSA-cp65-5m9r-vc2c Camaleon CMS vulnerable to arbitrary path traversal (GHSL-2024-183) | High | Also affects camaleon_cms |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor