PT-2022-12673 · Magnolia · Magnolia

Published 2022-02-11 · Updated 2022-04-19 · CVE-2021-46365

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Magnolia versions 6.2.3 and below

Description An issue in the Export function of Magnolia allows attackers to execute arbitrary code via a crafted XLF file. This issue enables attackers to perform XML External Entity attacks.

Recommendations For Magnolia versions 6.2.3 and below, consider disabling the Export function until a patch is available to prevent arbitrary code execution via crafted XLF files. Restrict access to the Export function to minimize the risk of exploitation. Avoid using the Export function with crafted XLF files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2021-46365

GHSA-3QPG-33WR-533J

Affected Products

Magnolia

References · 7

• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-46365-Unsafe%20XML%20Parsing-Magnolia%20CMS · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-46365 · Security Note
• https://docs.magnolia-cms.com/product-docs/6.2/Releases/Release-notes-for-Magnolia-CMS-6.2.4.html#_security_advisory · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3qpg-33wr-533j · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-46365 · Vendor Advisory
• https://t.me/cvenotify/26703 · Telegram Post
• https://t.me/cibsecurity/37356 · Telegram Post