CVE-2021-25972

    Dashboard / Vulnerabilities / CVE-2021-25972

    CVE-2021-25972

    Published: 20 Oct 2021Last Modified: 20 Oct 2026

    Summary:

    Details: In Camaleon CMS, versions 2.1.2.0 to 2.6.0, are vulnerable to Server-Side Request Forgery (SSRF) in the media upload feature, which allows admin users to fetch media files from external URLs but fails to validate URLs referencing to localhost or other internal servers. This allows attackers to read files stored in the internal server.

    References: https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25972, https://github.com/owen2345/camaleon-cms/commit/5a252d537411fdd0127714d66c1d76069dc7e190

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- cce1f27cbd4293f58ca66e736d33ed2f403b9209
    Fixed -None

    Affected versions

    2.6.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-25972 | CVE-DB