UpHeron
All vulnerabilities

Servers and applications

CVE-2021-22970

Concrete CMS (formerly concrete5) versions 8.5.6 and below and version 9.0.0 allow local IP importing causing the system to be vulnerable toa. SSRF attacks on the private LAN servers by reading files from the local LAN. An attacker can pivot in the private LAN and exploit local network appsandb. SSRF Mitigation Bypass through DNS RebindingConcrete CMS security team gave this a CVSS score of 3.5…

Severity
High 7.5
Published
19 Nov 2021
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
Concrete CMSServers and applications · cpe:a:concretecms:concrete_cms
  • Every version up to 8.5.6
  • Version 9.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-22970
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-22970