Critical · 9.8 CVE-2021-46386 EUVD-2022-0571GHSA-cwx9-rp4w-4545

Mingsoft MCMS vulnerable to Remote Code Execution via file upload.

Published Jan 26, 2022 · Updated Aug 4, 2024 · Assigned by mitre

Package: net.mingsoft:ms-mcms Ecosystem: Maven

Description

File upload vulnerability in mingSoft MCMS through 5.2.5, allows remote attackers to execute arbitrary code via a crafted jspx webshell to net.mingsoft.basic.action.web.FileAction#upload.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	net.mingsoft:ms-mcms	<= 5.2.5	—	GHSA-cwx9-rp4w-4545

References

https://gitee.com/mingSoft/MCMS/issues/I4R0GW