PT-2022-12278 · Icms · Icms

Published 2022-02-04 · Updated 2022-02-08 · CVE-2021-44978

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions iCMS versions 8.0.0 and earlier

Description The issue allows users to add and render a custom template, which has a Server-Side Template Injection (SSTI) vulnerability. This vulnerability can cause remote code execution.

Recommendations For versions 8.0.0 and earlier, update to a version later than 8.0.0 to resolve the issue. As a temporary workaround, consider restricting access to the template rendering functionality until a patch is available.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2021-44978

Affected Products

Icms

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-44978 · Security Note
• https://osv.dev/vulnerability/CVE-2021-44978 · Vendor Advisory
• https://icmsdev.com · Note
• https://gem-love.com/2021/12/10/ICMS-8-0-0%E5%90%8E%E5%8F%B0%E6%A8%A1%E6%9D%BF%E6%B3%A8%E5%85%A5%E5%AF%BC%E8%87%B4%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C0day%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90 · Note
• https://t.me/cibsecurity/36857 · Telegram Post