Staging Environment: Content and features may be unstable or change without notice.
Advisory details: ruby_advisory_db / gems/camaleon_cms/CVE-2021-25972
Advisory ID ruby_advisory_db/gems/camaleon_cms/CVE-2021-25972
Aliases CVE-2021-25972
GHSA-vx6p-q4gj-x6xx
Summary Camaleon CMS vulnerable to Server-Side Request Forgery In Camaleon CMS, versions 2.1.2.0 through 2.6.0, are vulnerable to Server-Side Request Forgery (SSRF) in the media upload feature, which allows admin users to fetch media files from external URLs but fails to validate URLs referencing to localhost or other internal servers. This allows attackers to read files stored in the internal server.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
cvssv3 4.9
Reference id Reference type URL
5a252d537411fdd0127714d66c1d76069dc7e190 Other https://github.com/owen2345/camaleon-cms/commit/5a252d537411fdd0127714d66c1d76069dc7e190
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T15:49:41Z/

Decision: Track

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2021/25xxx/CVE-2021-25972.json

Source Advisory: vulnrichment/CVE-2021-25972

View SSVC decision tree 
[{'Exploitation': 'poc'},
 {'Automatable': 'no'},
 {'Technical Impact': 'partial'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]