Camaleon CMS vulnerable to Server-Side Request Forgery

中 4.9CVE-2021-25972 · GHSA-vx6p-q4gj-x6xx · 20/10/2021 公開 · 17/06/2026 更新

要点

CVE-2021-25972 は camaleon_cms, camaleon cms (tuzitio) に影響する深刻度「中」 (CVSS 4.9) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.99%（全脆弱性の 62.4% より高い）。
対処：2.6.0.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
camaleon_cms RubyGems	`≥ 2.1.2.0, < 2.6.0.1`	`2.6.0.1`
camaleon cms tuzitio	`≥ 2.1.2.0, ≤ 2.6.0`	修正版なし

概要

In Camaleon CMS, versions 2.1.2.0 through 2.6.0, are vulnerable to Server-Side Request Forgery (SSRF) in the media upload feature, which allows admin users to fetch media files from external URLs but fails to validate URLs referencing to localhost or other internal servers. This allows attackers to read files stored in the internal server.

NVD の説明

In Camaleon CMS, versions 2.1.2.0 to 2.6.0, are vulnerable to Server-Side Request Forgery (SSRF) in the media upload feature, which allows admin users to fetch media files from external URLs but fails to validate URLs referencing to localhost or other internal servers. This allows attackers to read files stored in the internal server.