CVE-2021-25972
Camaleon CMS - Server-Side Request Forgery (SSRF) in Media Upload Feature
- State
- Published
- Severity
- 4.9 Medium
- Published
- Oct 20, 2021
- Updated
- Apr 30, 2025
- Reserved
- Jan 22, 2021
Description
In Camaleon CMS, versions 2.1.2.0 to 2.6.0, are vulnerable to Server-Side Request Forgery (SSRF) in the media upload feature, which allows admin users to fetch media files from external URLs but fails to validate URLs referencing to localhost or other internal servers. This allows attackers to read files stored in the internal server.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.9 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N | Mend |
Weaknesses
- CWE-918 Server-Side Request Forgery (SSRF)
Affected Products
| Product | Versions |
|---|---|
camaleon_cmscamaleon_cms |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.