PT-2022-20990 · Mcms · Mcms

Orangesky · Published 2022-07-01 · Updated 2023-05-08 · CVE-2022-31943

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MCMS version 5.2.8

Description The issue is related to an arbitrary file upload vulnerability. This means that an attacker could potentially upload malicious files to the system, which could lead to various security problems.

Recommendations For MCMS version 5.2.8, consider restricting access to file upload functionality until a patch is available. As a temporary workaround, disabling the file upload feature can help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-31943

GHSA-4828-473V-37GH

Affected Products

Mcms

References · 8

• 🔥 https://github.com/ming-soft/MCMS/issues/95 · Exploit
• https://osv.dev/vulnerability/GHSA-4828-473v-37gh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31943 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31943 · Vendor Advisory
• https://github.com/ming-soft/MCMS · Note
• https://t.me/cibsecurity/45526 · Telegram Post
• https://t.me/cvenotify/49942 · Telegram Post
• https://t.me/cvenotify/32530 · Telegram Post