GHSA-m4hg-5p2m-fm5m

Source

https://github.com/advisories/GHSA-m4hg-5p2m-fm5m

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-m4hg-5p2m-fm5m/GHSA-m4hg-5p2m-fm5m.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-m4hg-5p2m-fm5m

Aliases

CVE-2021-46361

Published

2022-02-12T00:00:37Z

Modified

2023-11-08T04:07:25.591729Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Arbitrary code execution in Magnolia CMS

Details

An issue in the Freemark Filter of Magnolia CMS v6.2.11 and below allows attackers to bypass security restrictions and execute arbitrary code via a crafted FreeMarker payload.

Database specific

{
    "nvd_published_at": "2022-02-11T21:15:00Z",
    "cwe_ids": [],
    "github_reviewed": true,
    "github_reviewed_at": "2022-02-14T22:43:02Z",
    "severity": "CRITICAL"
}

References

Affected packages

Maven / info.magnolia:magnolia-core

Package

Name: info.magnolia:magnolia-core; View open source insights on deps.dev
Purl: pkg:maven/info.magnolia/magnolia-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.2.12

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-m4hg-5p2m-fm5m/GHSA-m4hg-5p2m-fm5m.json"