PT-2022-18383 · Mcms · Mcms

Published 2022-04-22 · Updated 2022-05-06 · CVE-2022-27340

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MCMS version 5.2.7

Description The issue is related to a Cross-Site Request Forgery (CSRF) that occurs via the /role/saveOrUpdateRole.do endpoint. This allows attackers to escalate privileges and modify data.

Recommendations For MCMS version 5.2.7, consider disabling access to the /role/saveOrUpdateRole.do endpoint until a patch is available to prevent exploitation. Restricting privileges to minimize the risk of data modification is also recommended. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-27340

GHSA-G94P-H263-C26Q

Affected Products

Mcms

References · 6

• 🔥❌ https://github.com/UDKI11/vul/blob/main/Mcms%E8%B7%A8%E7%AB%99%E8%AF%B7%E6%B1%82%E4%BC%AA%E9%80%A0.docx · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2022-27340 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g94p-h263-c26q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27340 · Security Note
• https://github.com/ming-soft/MCMS · Note
• https://t.me/cibsecurity/41345 · Telegram Post