MCMS Arbitrary File Deletion vulnerability

ALTO 7.1CVE-2021-46062 · GHSA-rpvr-mw7r-25xx · Published 18/02/2022 · updated 17/06/2026

En resumen

CVE-2021-46062 es una vulnerabilidad ALTO (CVSS 7.1) que afecta a net.mingsoft:ms-basic, net.mingsoft:ms-mcms, mcms (mingsoft).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.77%, mayor que el 55.5% de las vulnerabilidades.
Solución: actualizar a 2.1.16, 5.2.11 o posterior.

Package	Affected versions	Patched versions
net.mingsoft:ms-basic Maven	`< 2.1.16`	`2.1.16`
net.mingsoft:ms-mcms Maven	`< 5.2.11`	`5.2.11`
mcms mingsoft	`= 5.2.5`	No fix yet

Description

net.mingsoft:ms-basic is used for plugin management for applications built with Maven for the Mingfei Content Management System (MCMS). ms-basic before 2.1.16 is vulnerable to arbitrary file deletion using POST requests to /template/writeFileContent via the oldFileName parameter. MCMS before 5.2.11 is also vulnerable since it bundles vulnerable versions of ms-basic.

NVD description

MCMS v5.2.5 was discovered to contain an arbitrary file deletion vulnerability via the component oldFileName.

References

nvd.nist.gov/vuln/detail/CVE-2021-46062 · ADVISORY
ming-soft/MCMS · WEB

Más vulnerabilidades de net.mingsoft:ms-basic

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free