Back Sploitus

CVE-2021

Sploitus • September 22, 2026

# CVE-2021-46364: Десериализация YAML в Magnolia CMS

Magnolia (версии <=6.2.3) использует парсер Snake YAML, уязвимый к атакам десериализации, которые могут позволить злоумышленнику вызывать произвольные конструкторы Java при импорте YAML-файлов.

С помощью этой уязвимости была достигнута удаленная выполнение кода.

Раскрытие информации и исправление этой уязвимости поставщиком можно найти здесь.

* Действительных учетных данных пользователя

Более подробная информация и процесс эксплуатации описаны в этом PDF.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs in Magnolia CMS Expose Users to Remote Code Execution A series of vulnerabilities affecting Magnolia CMS versions 6.2.3 and below have been disclosed, including CVE-2021-46366, CVE-2021-46362, CVE-2021-46361, and CVE-2021-46364. These vulnerabilities allow unauthorized access and remote code execution through various attack vectors such as CSRF, server-side template injection, and YAML deserialization. The vulnerabilities were published on February 11, 2022, with proof-of-concept (PoC) code for CVE-2021-46364 released on November 24, 2023. Users of affected systems are at risk of credential theft and arbitrary code execution. Vendors have issued advisories for remediation, but the exploitation status varies across the CVEs. Security professionals are urged to apply patches and monitor for signs of exploitation. 4 sources 65

Extracted Entities

CVE-2021

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Platforms (1)