GHSA-m4hg-5p2m-fm5m

Arbitrary code execution in Magnolia CMS

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-46361

Packages

Ecosystem	Package	Affected	Fixed in
Maven	info.magnolia:magnolia-core	< 6.2.12	6.2.12

Details

As written in the advisory (Markdown source, shown as plain text).

An issue in the Freemark Filter of Magnolia CMS v6.2.11 and below allows attackers to bypass security restrictions and execute arbitrary code via a crafted FreeMarker payload.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-46361 advisory
https://docs.magnolia-cms.com/product-docs/6.2/Releases/Release-notes-for-Magnolia-CMS-6.2.12.html#_security_advisory web
https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-46361-FreeMarker%20Bypass-Magnolia%20CMS web