CVE-2021-27312 - Vulnerability Details - OpenCVE

Server Side Request Forgery (SSRF) vulnerability in Gleez Cms 1.2.0, allows remote attackers to execute arbitrary code and obtain sensitive information via modules/gleez/classes/request.php.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Gleezcms	Gleez Cms

Configuration 1 [-]

cpe:2.3:a:gleezcms:gleez_cms:1.2.0:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://gist.github.com/LioTree/8d10d123d31f50db05a25586e62a87ba
https://github.com/gleez/cms/issues/805

History

Wed, 16 Apr 2025 15:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Gleezcms Gleezcms gleez Cms
CPEs		cpe:2.3:a:gleezcms:gleez_cms:1.2.0:::::::*
Vendors & Products		Gleezcms Gleezcms gleez Cms

Wed, 28 Aug 2024 20:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-918
Metrics		cvssV3_1 `{'score': 9.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-04-03T00:00:00

Updated: 2024-08-28T19:01:23.945Z

Reserved: 2021-02-16T00:00:00

Link: CVE-2021-27312

Vulnrichment

Updated: 2024-08-03T20:48:16.636Z

NVD

Status : Analyzed

Published: 2024-04-03T06:15:07.350

Modified: 2025-04-16T15:15:49.323

Link: CVE-2021-27312

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2021-27312", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-08-28T19:01:23.945Z", "dateReserved": "2021-02-16T00:00:00", "datePublished": "2024-04-03T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-04-03T05:39:11.567144"}, "descriptions": [{"lang": "en", "value": "Server Side Request Forgery (SSRF) vulnerability in Gleez Cms 1.2.0, allows remote attackers to execute arbitrary code and obtain sensitive information via modules/gleez/classes/request.php."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/gleez/cms/issues/805"}, {"url": "https://gist.github.com/LioTree/8d10d123d31f50db05a25586e62a87ba"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T20:48:16.636Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/gleez/cms/issues/805", "tags": ["x_transferred"]}, {"url": "https://gist.github.com/LioTree/8d10d123d31f50db05a25586e62a87ba", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-918", "lang": "en", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "affected": [{"vendor": "gleezcms", "product": "gleez_cms", "cpes": ["cpe:2.3:a:gleezcms:gleez_cms:1.0.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "1.2.0", "status": "affected"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.4, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-04-03T17:15:13.739173Z", "id": "CVE-2021-27312", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-28T19:01:23.945Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/gleez/cms/issues/805", "tags": ["x_transferred"]}, {"url": "https://gist.github.com/LioTree/8d10d123d31f50db05a25586e62a87ba", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T20:48:16.636Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.4, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2021-27312", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-04-03T17:15:13.739173Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:gleezcms:gleez_cms:1.0.0:*:*:*:*:*:*:*"], "vendor": "gleezcms", "product": "gleez_cms", "versions": [{"status": "affected", "version": "1.2.0"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-28T18:55:35.011Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/gleez/cms/issues/805"}, {"url": "https://gist.github.com/LioTree/8d10d123d31f50db05a25586e62a87ba"}], "descriptions": [{"lang": "en", "value": "Server Side Request Forgery (SSRF) vulnerability in Gleez Cms 1.2.0, allows remote attackers to execute arbitrary code and obtain sensitive information via modules/gleez/classes/request.php."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-04-03T05:39:11.567144"}}}, "cveMetadata": {"cveId": "CVE-2021-27312", "state": "PUBLISHED", "dateUpdated": "2024-08-28T19:01:23.945Z", "dateReserved": "2021-02-16T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-04-03T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}