GitHub Advisoryadvisory · Maven

GHSA-rpvr-mw7r-25xx MCMS Arbitrary File Deletion vulnerability

HIGH Published 2022-02-19 Modified 2023-09-25 Official page ↗
Aliases
CVE-2021-46062
Ecosystem
Maven
Packages
net.mingsoft:ms-basic, net.mingsoft:ms-mcms
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Weaknesses
CWE-22
Reviewed
2022-03-01

Affected packages

• Maven net.mingsoft:ms-basic: < 2.1.16 → fixed in 2.1.16 • Maven net.mingsoft:ms-mcms: < 5.2.11 → fixed in 5.2.11

Description

`net.mingsoft:ms-basic` is used for plugin management for applications built with Maven for the Mingfei Content Management System (MCMS). ms-basic before 2.1.16 is vulnerable to arbitrary file deletion using POST requests to `/template/writeFileContent` via the `oldFileName` parameter. MCMS before 5.2.11 is also vulnerable since it bundles vulnerable versions of ms-basic.

Related

Alias · CVE (1)

  • CVE-2021-46062 MCMS v5.2.5 was discovered to contain an arbitrary file deletion vulnerability via the component oldFileName. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References