PT-2022-12674 · Magnolia · Magnolia Cms

Drunkenshells · Published 2022-02-11 · Updated 2022-07-12 · CVE-2021-46366

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Magnolia CMS versions 6.2.3 and below

Description An issue in the Login page of Magnolia CMS allows attackers to exploit both an Open Redirect vulnerability and Cross-Site Request Forgery (CSRF) in order to brute force and exfiltrate users' credentials.

Recommendations For Magnolia CMS versions 6.2.3 and below, update to a version above 6.2.3 to resolve the issue. As a temporary workaround, consider restricting access to the Login page to minimize the risk of exploitation. Avoid using the Login page until the issue is resolved.

Exploit

Fix

Open Redirect

CSRF

Weakness Enumeration

CWE-601

CWE-352

Related Identifiers

CVE-2021-46366

GHSA-HXVF-35W8-F5MW

Affected Products

Magnolia Cms

References · 7

• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-46366-CSRF%2BOpen%20Redirect-Magnolia%20CMS · Exploit
• https://osv.dev/vulnerability/GHSA-hxvf-35w8-f5mw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-46366 · Security Note
• https://docs.magnolia-cms.com/product-docs/6.2/Releases/Release-notes-for-Magnolia-CMS-6.2.4.html#_security_advisory · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-46366 · Vendor Advisory
• https://t.me/cibsecurity/37361 · Telegram Post
• https://t.me/cvenotify/26702 · Telegram Post