php · aimeos/pagibleHeads-up
Aimeos Pagible CMS SSRF via DNS rebinding in admin proxy route
The administrative proxy route in Aimeos Pagible CMS has a TOCTOU race condition between URL validation and HTTP request, allowing SSRF via DNS rebinding.
What changed
The administrative proxy route in Aimeos Pagible CMS has a TOCTOU race condition between URL validation and HTTP request, allowing SSRF via DNS rebinding.
Who it affects
Users of Aimeos Pagible CMS with the administrative proxy route enabled and accessible.
What to do today
Apply the vendor-provided patch or disable the proxy route if not needed.
The trail
Collected→
Audited→
Written→
Published