CVE-2021-25972 MEDIUM

CVE-2021-25972: Camaleon CMS - Server-Side Request Forgery (SSRF) in Media Upload Feature

Vendor Camaleon_Cms
Product camaleon_cms
Weakness CWE-918 · SSRF
Published October 20, 2021
Last update April 30, 2025
View on NVD All CVEs

CVSS base score

4.9/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

In Camaleon CMS, versions 2.1.2.0 to 2.6.0, are vulnerable to Server-Side Request Forgery (SSRF) in the media upload feature, which allows admin users to fetch media files from external URLs but fails to validate URLs referencing to localhost or other internal servers. This allows attackers to read files stored in the internal server.

Key dates

02Disclosure timeline

October 20, 2021 CVE published
April 30, 2025 Record updated