Remote code execution in net.mingsoft:ms-mcms

緊急 9.8CVE-2021-46384 · GHSA-qwh6-xwj4-9cjg · 04/03/2022 公開 · 17/06/2026 更新

要点

CVE-2021-46384 は net.mingsoft:ms-mcms, mcms (mingsoft) に影響する深刻度「緊急」 (CVSS 9.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：2.2%（全脆弱性の 82.7% より高い）。
対処：5.2.6 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
net.mingsoft:ms-mcms Maven	`< 5.2.6`	`5.2.6`
mcms mingsoft	`≤ 5.2.5`	修正版なし

概要

net.mingsoft:ms-mcms <=5.2.5 is affected by: RCE. The impact is: execute arbitrary code (remote). The attack vector is: ${"freemarker.template.utility.Execute"?new()("calc")}. ¶¶ MCMS has a pre-auth RCE vulnerability through which allows unauthenticated attacker with network access via http to compromise MCMS. Successful attacks of this vulnerability can result in takeover of MCMS.

NVD の説明

https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: RCE. The impact is: execute arbitrary code (remote). The attack vector is: ${"freemarker.template.utility.Execute"?new()("calc")}. ¶¶ MCMS has a pre-auth RCE vulnerability through which allows unauthenticated attacker with network access via http to compromise MCMS. Successful attacks of this vulnerability can result in takeover of MCMS.