Vulnerability Description
In Camaleon CMS, versions 2.1.2.0 to 2.6.0, are vulnerable to Server-Side Request Forgery (SSRF) in the media upload feature, which allows admin users to fetch media files from external URLs but fails to validate URLs referencing to localhost or other internal servers. This allows attackers to read files stored in the internal server.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Tuzitio | Camaleon Cms | >= 2.1.2.0, <= 2.6.0 |
Related Weaknesses (CWE)
References
- https://github.com/owen2345/camaleon-cms/commit/5a252d537411fdd0127714d66c1d7606PatchThird Party Advisory
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25972Third Party Advisory
- https://github.com/owen2345/camaleon-cms/commit/5a252d537411fdd0127714d66c1d7606PatchThird Party Advisory
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25972Third Party Advisory
FAQ
What is CVE-2021-25972?
CVE-2021-25972 is a vulnerability with a CVSS score of 4.9 (MEDIUM). In Camaleon CMS, versions 2.1.2.0 to 2.6.0, are vulnerable to Server-Side Request Forgery (SSRF) in the media upload feature, which allows admin users to fetch media files from external URLs but fails...
How severe is CVE-2021-25972?
CVE-2021-25972 has been rated MEDIUM with a CVSS base score of 4.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-25972?
Check the references section above for vendor advisories and patch information. Affected products include: Tuzitio Camaleon Cms.