Vulnerability · Published Mar 4, 2022 · Assigned by mitre

CVE-2021-46384

Critical 9.8

In plain English

A critical-severity security flaw in the net.mingsoft:ms-mcms package (Maven). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)2.2%top 17.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: RCE. The impact is: execute arbitrary code (remote). The attack vector is: ${"freemarker.template.utility.Execute"?new()("calc")}. ¶¶ MCMS has a pre-auth RCE vulnerability through which allows unauthenticated attacker with network access via http to compromise MCMS. Successful attacks of this vulnerability can result in takeover of MCMS.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	net.mingsoft:ms-mcms	5.2.6	GHSA-qwh6-xwj4-9cjg

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gitee.com/mingSoft/MCMS/issues/I4QZ1O x_refsource_MISC