GHSA-gc79-gh4f-9g6w CVE-2021-46063
Server Side Template Injection in MCMS
- Severity
- 9.1 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- 2.73%
- Chance of exploitation in the next 30 days. Higher than 86.09% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- Fix
- None yet
- No fixed version published
Description
MCMS v5.2.5 was discovered to contain a Server Side Template Injection (SSTI) vulnerability via the Template Management module.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| net.mingsoft:ms-mcms | <= 5.2.5 |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Weakness
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
How to prevent it
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
References
Advisories
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-r9wp-qq53-qvjx mingSoft MCMS does not properly restrict file uploads | High | Also affects net.mingsoft:ms-mcms |
| GHSA-wvv5-5g6x-hp7j MCMS reflected cross-site scripting (XSS) vulnerability | Medium | Also affects net.mingsoft:ms-mcms |
| GHSA-54wc-49qj-5ghj MCMS vulnerable SQL injection via the content_title parameter | Critical | Also affects net.mingsoft:ms-mcms |
| GHSA-3922-2r6r-r4fv MCMS allows arbitrary file uploads in the ueditor component | Critical | Also affects net.mingsoft:ms-mcms |
| GHSA-7qw4-9r68-2rmx mingSoft MCMS File Upload vulnerability | High | Also affects net.mingsoft:ms-mcms |
| GHSA-h57w-vh34-f8cw Code injection in mingSoft MCMS | High | Also affects net.mingsoft:ms-mcms |
| GHSA-3vvh-8c65-32j4 Mingsoft MCMS SQL injection | Critical | Also affects net.mingsoft:ms-mcms |
| GHSA-rxvj-5mv6-j5mc Cross-site Scripting in Mingsoft MCMS | Medium | Also affects net.mingsoft:ms-mcms |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor