PT-2021-14293 · Powercms · Powercms

Published 2021-11-24 · Updated 2021-11-29 · CVE-2021-20850

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: PowerCMS versions 5.19 and earlier PowerCMS versions 4.49 and earlier PowerCMS versions 3.295 and earlier PowerCMS 2 Series (End-of-Life, EOL)

Description: The PowerCMS XMLRPC API allows a remote attacker to execute an arbitrary OS command via unspecified vectors. This issue affects multiple versions of PowerCMS, including 5.19 and earlier, 4.49 and earlier, 3.295 and earlier, and the PowerCMS 2 Series, which is End-of-Life.

Recommendations: For PowerCMS versions 5.19 and earlier, update to a version later than 5.19 to resolve the issue. For PowerCMS versions 4.49 and earlier, update to a version later than 4.49 to resolve the issue. For PowerCMS versions 3.295 and earlier, update to a version later than 3.295 to resolve the issue. For PowerCMS 2 Series, since it is End-of-Life, consider upgrading to a supported version of PowerCMS to mitigate the risk. As a temporary workaround, consider disabling the XMLRPC API until a patch is available.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-20850

Affected Products

Powercms

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-20850 · Security Note
• https://osv.dev/vulnerability/CVE-2021-20850 · Vendor Advisory
• https://powercms.jp/news/release-patch-xmlrpc-api-202110.html · Vendor Advisory
• https://t.me/cvenotify/23735 · Telegram Post
• https://jvn.jp/en/jp/JVN17645965/index.html · Note
• https://t.me/cibsecurity/32959 · Telegram Post