CVE-2021-22969 json
Server-Side Request Forgery in Concrete CMS
published 2021-11-19 4 y ago modified 2026-06-17 4 mo ago also GHSA-mcxr-fx5f-96qq , EUVD-2021-2368
- cvss
- 5.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 58%
- public exploits
- 0
- none known
Summary
Concrete CMS (formerly concrete5) versions below 8.5.7 has a SSRF mitigation bypass using DNS Rebind attack giving an attacker the ability to fetch cloud IAAS (ex AWS) IAM keys.To fix this Concrete CMS no longer allows downloads from the local network and specifies the validated IP when downloading rather than relying on DNS.Discoverer: Adrian Tiron from FORTBRIDGE ( https://www.fortbridge.co.uk/ )The Concrete CMS team gave this a CVSS 3.1 score of 3.5 AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N . Please note that Cloud IAAS provider mis-configurations are not Concrete CMS vulnerabilities. A mitigation for this vulnerability is to make sure that the IMDS configurations are according to a cloud provider's best practices.This fix is also in Concrete version 9.0.0
Patch / fix
- packagist concrete5/core 8.5.7
- concretecms concrete_cms 8.5.7
Exploit prediction
0.86% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | concrete5/core | <8.5.7 |
8.5.7 |
Affected products
- n/a https://github.com/concrete5/concrete5
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
documentation.concretecms.org
/developers/introduction/version-history/857-release-notes
web, release-notes, vendor-advisory
-
hackerone.com
/reports/1369312
web, permissions-required
-
nvd.nist.gov
/vuln/detail/CVE-2021-22969
advisory
Sources
- CVE List CVE-2021-22969
- GitHub Advisory GHSA-mcxr-fx5f-96qq
- NVD CVE-2021-22969
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.