CVE-2021-22958

A Server-Side Request Forgery vulnerability was found in concrete5 < 8.5.5 that allowed a decimal notation encoded IP address to bypass the limitations in place for localhost allowing interaction with local services. Impact can vary depending on services exposed.CVSSv2.0 AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

• CWE-918
• CWE-918

• https://documentation.concretecms.org/developers/introduction/version-history/855-release-notesRelease Notes, Vendor Advisory
• https://hackerone.com/reports/863221Issue Tracking, Permissions Required, Third Party Advisory
• https://documentation.concretecms.org/developers/introduction/version-history/855-release-notesRelease Notes, Vendor Advisory
• https://hackerone.com/reports/863221Issue Tracking, Permissions Required, Third Party Advisory

Published

Oct 7, 2021

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-22952A vulnerability found in UniFi Talk application V1.12.3 and …8.8
• CVE-2021-22953A CSRF in Concrete CMS version 8.5.5 and below allows an att…5.4
• CVE-2021-22954A cross-site request forgery vulnerability exists in Concret…8.8
• CVE-2021-22955A unauthenticated denial of service vulnerability exists in …7.5
• CVE-2021-22956An uncontrolled resource consumption vulnerability exists in…7.5
• CVE-2021-22957A Cross-Origin Resource Sharing (CORS) vulnerability found i…8.8
• CVE-2021-22959The parser in accepts requests with a space (SP) right after…6.5
• CVE-2021-2296Vulnerability in the Oracle VM VirtualBox product of Oracle …5.3
• CVE-2021-22960The parse function in llhttp < 2.1.4 and < 6.0.6. ignores ch…6.5
• CVE-2021-22961A code injection vulnerability exists within the firewall so…9.8
• CVE-2021-22962An attacker can send a specially crafted request which could…9.1
• CVE-2021-22963A redirect vulnerability in the fastify-static module versio…6.1