CyberRota Analysis
AI-GeneratedThe Aimeos Pagible content management system prior to version 0.10.4 is vulnerable to a Server-Side Request Forgery (SSRF) attack due to a race condition in the administrative proxy route, which can be exploited via DNS Rebinding. This vulnerability allows attackers to access internal network resources and cloud metadata endpoints, potentially compromising sensitive information. Administrators using affected versions should prioritize upgrading to version 0.10.4 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In the Aimeos Pagible content management system prior to version 0.10.4, the administrative proxy route (`cmsproxy`) is vulnerable to a Server-Side Request Forgery (SSRF) attack via DNS Rebinding. A Time-of-Check to Time-of-Use (TOCTOU) race condition exists between the URL validation phase and the actual HTTP request phase, allowing attackers to access internal network resources and cloud metadata endpoints. Version 0.10.4 fixes the issue.