PT-2022-12669 · Magnolia · Magnolia Cms

Published 2022-02-11 · Updated 2022-02-22 · CVE-2021-46361

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Magnolia CMS versions 6.2.11 and below

Description An issue in the Freemark Filter of Magnolia CMS allows attackers to bypass security restrictions and execute arbitrary code via a crafted FreeMarker payload.

Recommendations For Magnolia CMS versions 6.2.11 and below, update to a version above 6.2.11 to resolve the issue. As a temporary workaround, consider restricting access to the Freemark Filter to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2021-46361

GHSA-M4HG-5P2M-FM5M

Affected Products

Magnolia Cms

References · 7

• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-46361-FreeMarker%20Bypass-Magnolia%20CMS · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-46361 · Security Note
• https://osv.dev/vulnerability/CVE-2021-46361 · Vendor Advisory
• https://docs.magnolia-cms.com/product-docs/6.2/Releases/Release-notes-for-Magnolia-CMS-6.2.12.html#_security_advisory · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m4hg-5p2m-fm5m · Vendor Advisory
• https://t.me/cibsecurity/37357 · Telegram Post
• https://t.me/cvenotify/27035 · Telegram Post