| Package | Affected versions | Patched versions |
|---|---|---|
| concrete5/concrete5 | < 8.5.5 | 8.5.5 |
| concrete cms | < 8.5.5 | 8.5.5 |
A Server-Side Request Forgery vulnerability was found in concrete5 < 8.5.5 that allowed a decimal notation encoded IP address to bypass the limitations in place for localhost allowing interaction with local services. Impact can vary depending on services exposed.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free