GHSA-rpvr-mw7r-25xx

ghsaUSosv

MCMS Arbitrary File Deletion vulnerability

view advisory published 2022-02-19Licence: CC-BY-4.0

`net.mingsoft:ms-basic` is used for plugin management for applications built with Maven for the [Mingfei Content Management System (MCMS)](https://gitee.com/mingSoft/MCMS). ms-basic before 2.1.16 is vulnerable to arbitrary file deletion using POST requests to `/template/writeFileContent` via the `oldFileName` parameter. MCMS before 5.2.11 is also vulnerable since it bundles vulnerable versions of ms-basic.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-46062US	high7.1	0.77% (55th)	—	2022-02-18
MCMS v5.2.5 was discovered to contain an arbitrary file deletion vulnerability via the component oldFileName.

references

External citations — patches, advisories, analysis.

https://github.com/ming-soft/MCMS/issues/59WEB
https://nvd.nist.gov/vuln/detail/CVE-2021-46062ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan