Back Sploitus

CVE-2021

Sploitus • September 22, 2026

# CVE-2021-46361: Обход ограничений FreeMarker в Magnolia CMS

Проблема в FreeMarker Filter в Magnolia CMS v6.2.11 и ниже позволяет злоумышленникам обходить ограничения безопасности и выполнять произвольный код с помощью специально созданного FreeMarker-payload.

Раскрытие информации и исправление этой уязвимости вендором можно найти здесь.

Более подробная информация и процесс эксплуатации приведены в этом PDF.

SSTI-гаджет, использованный для выхода из песочницы FreeMarker, был вдохновлён этой статьёй автора Винсента Хербулота из Synacktiv.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs in Magnolia CMS Expose Users to Remote Code Execution A series of vulnerabilities affecting Magnolia CMS versions 6.2.3 and below have been disclosed, including CVE-2021-46366, CVE-2021-46362, CVE-2021-46361, and CVE-2021-46364. These vulnerabilities allow unauthorized access and remote code execution through various attack vectors such as CSRF, server-side template injection, and YAML deserialization. The vulnerabilities were published on February 11, 2022, with proof-of-concept (PoC) code for CVE-2021-46364 released on November 24, 2023. Users of affected systems are at risk of credential theft and arbitrary code execution. Vendors have issued advisories for remediation, but the exploitation status varies across the CVEs. Security professionals are urged to apply patches and monitor for signs of exploitation. 4 sources 65

Extracted Entities

CVE-2021

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (1)

Platforms (2)