Vulnerability · Published May 31, 2022 · Assigned by mitre
CVE-2022-29647
High 8.8
In plain English
A high-severity security flaw in the net.mingsoft:ms-mcms package (Maven). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Severity (CVSS NVD)8.8High
Exploit odds (30 days)0.7%top 48.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An issue was discovered in MCMS 5.2.7. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | net.mingsoft:ms-mcms | no fix listed | GHSA-gp39-qj5f-43qv |
Affected products (as reported)
References
- https://gist.github.com/aaaahuia/f708c6c8a320e0f3afbb9247903c4670 x_refsource_MISC