Description

A vulnerability in the Snake YAML parser of Magnolia CMS v6.2.3 and below allows attackers to execute arbitrary code via a crafted YAML file.

Remediation

References

https://docs.magnolia-cms.com/product-docs/6.2/Releases/Release-notes-for-Magnolia-CMS-6.2.4.html#_security_advisory

https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2021-46364-YAML%20Deserialization-Magnolia%20CMS

Related Vulnerabilities

CVE-2022-45146 Vulnerability in maven package org.bouncycastle:bc-fips-debug

CVE-2022-21213 Vulnerability in npm package mout

CVE-2022-38900 Vulnerability in npm package decode-uri-component

CVE-2023-50765 Vulnerability in maven package org.jenkins-ci.plugins:scriptler

CVE-2022-4135 Vulnerability in npm package electron

Severity

High

Classification

CWE-502 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Tags

Release Notes Vendor Advisory Exploit Third Party Advisory