GHSA-77hh-p7r6-66pv

Source

https://github.com/advisories/GHSA-77hh-p7r6-66pv

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-77hh-p7r6-66pv/GHSA-77hh-p7r6-66pv.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-77hh-p7r6-66pv

Aliases

CVE-2022-22929

Published

2022-01-22T00:00:50Z

Modified

2024-02-16T08:18:15.322182Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Arbitrary File Upload in Mingsoft MCMS

Details

MCMS v5.2.4 was discovered to have an arbitrary file upload vulnerability in the New Template module, which allows attackers to execute arbitrary code via a crafted ZIP file.

Database specific

{
    "nvd_published_at": "2022-01-21T00:15:00Z",
    "cwe_ids": [
        "CWE-434"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-08T00:05:45Z"
}

References

Affected packages

Maven / net.mingsoft:ms-mcms

Package

Name: net.mingsoft:ms-mcms; View open source insights on deps.dev
Purl: pkg:maven/net.mingsoft/ms-mcms

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

5.2.4

Affected versions

4.*

4.6.3-SNAPSHOTS

4.6.5

4.7.1

4.7.2

5.*

5.0.0

5.0.1

5.1

5.2

5.2.0

5.2.0.RELEASE

5.2.1

5.2.2

5.2.3

5.2.4