GitHub Advisoryadvisory · Maven

GHSA-cwx9-rp4w-4545 Mingsoft MCMS vulnerable to Remote Code Execution via file upload.

CRITICAL Published 2022-01-27 Modified 2022-10-25 Official page ↗
Aliases
CVE-2021-46386
Ecosystem
Maven
Packages
net.mingsoft:ms-mcms
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-434
Reviewed
2022-10-25

Affected packages

• Maven net.mingsoft:ms-mcms: <= 5.2.5 (no fix yet)

Description

Mingsoft MCMS is a Java CMS. Versions prior to and including 5.2.5 contain a file upload vulnerability allowing for a jspx webshell to be uploaded via net.mingsoft.basic.action.web.FileAction#upload, resulting in remote code execution. It is unclear if this issue has been patched.

Related

Alias · CVE (1)

  • CVE-2021-46386 File upload vulnerability in mingSoft MCMS through 5.2.5, allows remote attackers to execute arbitrary code via a crafted jspx webshell to… vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References