github - ghsa-vx6p-q4gj-x6xx

ghsa-vx6p-q4gj-x6xx

Vulnerability from github

Published

2022-05-24 19:18

Modified

2023-01-26 23:52

Severity ?

4.9 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Summary

Camaleon CMS vulnerable to Server-Side Request Forgery

Details

In Camaleon CMS, versions 2.1.2.0 through 2.6.0, are vulnerable to Server-Side Request Forgery (SSRF) in the media upload feature, which allows admin users to fetch media files from external URLs but fails to validate URLs referencing to localhost or other internal servers. This allows attackers to read files stored in the internal server.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "camaleon_cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.1.2.0"
            },
            {
              "fixed": "2.6.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-25972"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-01-26T23:52:12Z",
    "nvd_published_at": "2021-10-20T12:15:00Z",
    "severity": "MODERATE"
  },
  "details": "In Camaleon CMS, versions 2.1.2.0 through 2.6.0, are vulnerable to Server-Side Request Forgery (SSRF) in the media upload feature, which allows admin users to fetch media files from external URLs but fails to validate URLs referencing to localhost or other internal servers. This allows attackers to read files stored in the internal server.",
  "id": "GHSA-vx6p-q4gj-x6xx",
  "modified": "2023-01-26T23:52:12Z",
  "published": "2022-05-24T19:18:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25972"
    },
    {
      "type": "WEB",
      "url": "https://github.com/owen2345/camaleon-cms/commit/5a252d537411fdd0127714d66c1d76069dc7e190"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/owen2345/camaleon-cms"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/camaleon_cms/CVE-2021-25972.yml"
    },
    {
      "type": "WEB",
      "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25972"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Camaleon CMS vulnerable to Server-Side Request Forgery"
}

gsd-2021-25972

Vulnerability from gsd

Modified

2022-05-24 00:00

Details

Aliases

CVE-2021-25972

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2021-25972",
    "description": "In Camaleon CMS, versions 2.1.2.0 to 2.6.0, are vulnerable to Server-Side Request Forgery (SSRF) in the media upload feature, which allows admin users to fetch media files from external URLs but fails to validate URLs referencing to localhost or other internal servers. This allows attackers to read files stored in the internal server.",
    "id": "GSD-2021-25972"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "affected": [
        {
          "package": {
            "ecosystem": "RubyGems",
            "name": "camaleon_cms",
            "purl": "pkg:gem/camaleon_cms"
          }
        }
      ],
      "aliases": [
        "CVE-2021-25972",
        "GHSA-vx6p-q4gj-x6xx"
      ],
      "details": "In Camaleon CMS, versions 2.1.2.0 through 2.6.0, are vulnerable to Server-Side\nRequest Forgery (SSRF) in the media upload feature, which allows admin users to\nfetch media files from external URLs but fails to validate URLs referencing to localhost\nor other internal servers. This allows attackers to read files stored in the internal\nserver.\n",
      "id": "GSD-2021-25972",
      "modified": "2022-05-24T00:00:00.000Z",
      "published": "2022-05-24T00:00:00.000Z",
      "references": [
        {
          "type": "WEB",
          "url": "https://github.com/owen2345/camaleon-cms/commit/5a252d537411fdd0127714d66c1d76069dc7e190"
        },
        {
          "type": "WEB",
          "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25972"
        }
      ],
      "schema_version": "1.4.0",
      "severity": [
        {
          "score": 4.9,
          "type": "CVSS_V3"
        }
      ],
      "summary": "Camaleon CMS vulnerable to Server-Side Request Forgery"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "vulnerabilitylab@whitesourcesoftware.com",
        "ID": "CVE-2021-25972",
        "STATE": "PUBLIC",
        "TITLE": "Camaleon CMS - Server-Side Request Forgery (SSRF) in Media Upload Feature"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "camaleon_cms",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003e=",
                          "version_value": "2.1.2.0"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_value": "2.6.0"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "camaleon_cms"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "In Camaleon CMS, versions 2.1.2.0 to 2.6.0, are vulnerable to Server-Side Request Forgery (SSRF) in the media upload feature, which allows admin users to fetch media files from external URLs but fails to validate URLs referencing to localhost or other internal servers. This allows attackers to read files stored in the internal server."
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "impact": {
        "cvss": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-918 Server-Side Request Forgery (SSRF)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/owen2345/camaleon-cms/commit/5a252d537411fdd0127714d66c1d76069dc7e190",
            "refsource": "MISC",
            "url": "https://github.com/owen2345/camaleon-cms/commit/5a252d537411fdd0127714d66c1d76069dc7e190"
          },
          {
            "name": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25972",
            "refsource": "MISC",
            "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25972"
          }
        ]
      },
      "solution": [
        {
          "lang": "eng",
          "value": "Update to 2.6.0.1"
        }
      ],
      "source": {
        "advisory": "https://www.whitesourcesoftware.com/vulnerability-database/",
        "discovery": "UNKNOWN"
      }
    },
    "github.com/rubysec/ruby-advisory-db": {
      "cve": "2021-25972",
      "cvss_v3": 4.9,
      "date": "2022-05-24",
      "description": "In Camaleon CMS, versions 2.1.2.0 through 2.6.0, are vulnerable to Server-Side\nRequest Forgery (SSRF) in the media upload feature, which allows admin users to\nfetch media files from external URLs but fails to validate URLs referencing to localhost\nor other internal servers. This allows attackers to read files stored in the internal\nserver.\n",
      "gem": "camaleon_cms",
      "ghsa": "vx6p-q4gj-x6xx",
      "patched_versions": [
        "\u003e= 2.6.0.1"
      ],
      "related": {
        "url": [
          "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25972"
        ]
      },
      "title": "Camaleon CMS vulnerable to Server-Side Request Forgery",
      "unaffected_versions": [
        "\u003c 2.1.2.0"
      ],
      "url": "https://github.com/owen2345/camaleon-cms/commit/5a252d537411fdd0127714d66c1d76069dc7e190"
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003e=2.1.2.0 \u003c=2.6.0",
          "affected_versions": "All versions starting from 2.1.2.0 up to 2.6.0",
          "cvss_v2": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-918",
            "CWE-937"
          ],
          "date": "2021-10-25",
          "description": "In Camaleon CMS to, are vulnerable to Server-Side Request Forgery (SSRF) in the media upload feature, which allows admin users to fetch media files from external URLs but fails to validate URLs referencing to localhost or other internal servers. This allows attackers to read files stored in the internal server.",
          "fixed_versions": [
            "2.6.0.1"
          ],
          "identifier": "CVE-2021-25972",
          "identifiers": [
            "CVE-2021-25972"
          ],
          "not_impacted": "All versions before 2.1.2.0, all versions after 2.6.0",
          "package_slug": "gem/camaleon_cms",
          "pubdate": "2021-10-20",
          "solution": "Upgrade to version 2.6.0.1 or above.",
          "title": "Server-Side Request Forgery (SSRF)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-25972"
          ],
          "uuid": "56d57e84-9440-4a52-bad9-acf120f7d94f"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:tuzitio:camaleon_cms:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "2.6.0",
                "versionStartIncluding": "2.1.2.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "vulnerabilitylab@whitesourcesoftware.com",
          "ID": "CVE-2021-25972"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "In Camaleon CMS, versions 2.1.2.0 to 2.6.0, are vulnerable to Server-Side Request Forgery (SSRF) in the media upload feature, which allows admin users to fetch media files from external URLs but fails to validate URLs referencing to localhost or other internal servers. This allows attackers to read files stored in the internal server."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-918"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/owen2345/camaleon-cms/commit/5a252d537411fdd0127714d66c1d76069dc7e190",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/owen2345/camaleon-cms/commit/5a252d537411fdd0127714d66c1d76069dc7e190"
            },
            {
              "name": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25972",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25972"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 8.0,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 1.2,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2021-10-25T19:20Z",
      "publishedDate": "2021-10-20T12:15Z"
    }
  }
}

cve-2021-25972

Vulnerability from cvelistv5

Published

2021-10-20 11:55

Modified

2024-08-03 20:19

Severity ?

4.9 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Summary

In Camaleon CMS, versions 2.1.2.0 to 2.6.0, are vulnerable to Server-Side Request Forgery (SSRF) in the media upload feature, which allows admin users to fetch media files from external URLs but fails to validate URLs referencing to localhost or other internal servers. This allows attackers to read files stored in the internal server.

References

▼	URL	Tags
	https://github.com/owen2345/camaleon-cms/commit/5a252d537411fdd0127714d66c1d76069dc7e190	x_refsource_MISC
	https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25972	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	camaleon_cms	camaleon_cms	Version: 2.1.2.0 < unspecified Version: unspecified <

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T20:19:19.023Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/owen2345/camaleon-cms/commit/5a252d537411fdd0127714d66c1d76069dc7e190"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25972"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "camaleon_cms",
          "vendor": "camaleon_cms",
          "versions": [
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "2.1.2.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "2.6.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Camaleon CMS, versions 2.1.2.0 to 2.6.0, are vulnerable to Server-Side Request Forgery (SSRF) in the media upload feature, which allows admin users to fetch media files from external URLs but fails to validate URLs referencing to localhost or other internal servers. This allows attackers to read files stored in the internal server."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-20T11:55:19",
        "orgId": "478c68dd-22c1-4a41-97cd-654224dfacff",
        "shortName": "Mend"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/owen2345/camaleon-cms/commit/5a252d537411fdd0127714d66c1d76069dc7e190"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25972"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update to 2.6.0.1"
        }
      ],
      "source": {
        "advisory": "https://www.whitesourcesoftware.com/vulnerability-database/",
        "discovery": "UNKNOWN"
      },
      "title": "Camaleon CMS - Server-Side Request Forgery (SSRF) in Media Upload Feature",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vulnerabilitylab@whitesourcesoftware.com",
          "ID": "CVE-2021-25972",
          "STATE": "PUBLIC",
          "TITLE": "Camaleon CMS - Server-Side Request Forgery (SSRF) in Media Upload Feature"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "camaleon_cms",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003e=",
                            "version_value": "2.1.2.0"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_value": "2.6.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "camaleon_cms"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Camaleon CMS, versions 2.1.2.0 to 2.6.0, are vulnerable to Server-Side Request Forgery (SSRF) in the media upload feature, which allows admin users to fetch media files from external URLs but fails to validate URLs referencing to localhost or other internal servers. This allows attackers to read files stored in the internal server."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-918 Server-Side Request Forgery (SSRF)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/owen2345/camaleon-cms/commit/5a252d537411fdd0127714d66c1d76069dc7e190",
              "refsource": "MISC",
              "url": "https://github.com/owen2345/camaleon-cms/commit/5a252d537411fdd0127714d66c1d76069dc7e190"
            },
            {
              "name": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25972",
              "refsource": "MISC",
              "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25972"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Update to 2.6.0.1"
          }
        ],
        "source": {
          "advisory": "https://www.whitesourcesoftware.com/vulnerability-database/",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "478c68dd-22c1-4a41-97cd-654224dfacff",
    "assignerShortName": "Mend",
    "cveId": "CVE-2021-25972",
    "datePublished": "2021-10-20T11:55:19",
    "dateReserved": "2021-01-22T00:00:00",
    "dateUpdated": "2024-08-03T20:19:19.023Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

ghsa-vx6p-q4gj-x6xx

Vulnerability from github

gsd-2021-25972

Vulnerability from gsd

cve-2021-25972

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature