GHSA-gc45-j3m5-8qfq

    Dashboard / Vulnerabilities / GHSA-gc45-j3m5-8qfq

    GHSA-gc45-j3m5-8qfq

    Published: 8 Jun 2021Last Modified: 16 Feb 2024

    Summary: Server-Side Request Forgery in Feehi CMS

    Details: Feehi CMS 2.1.1 is affected by a Server-side request forgery (SSRF) vulnerability. When the user modifies the HTTP Referer header to any url, the server can make a request to it.

    References: https://nvd.nist.gov/vuln/detail/CVE-2021-30108, https://github.com/liufee/cms/issues/57, https://github.com/liufee/cms/issues/57#issuecomment-1230070460, https://github.com/liufee/cms/commit/d45cb9cb26d6f5ef491fa2c7d87ac7f26091bd7c

    Affected packages

    Package

    Name: feehi/cms

    Purl: pkg:composer/feehi/cms

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    0.0.1
    0.0.2
    0.0.3
    0.0.4
    0.0.5
    0.0.6
    0.0.7
    0.0.8
    0.0.9

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-gc45-j3m5-8qfq | CVE-DB