Back Sploitus

CVE-2021

Sploitus • September 22, 2026

# CVE-2021-46362: Серверная инъекция шаблонов FreeMarker в Magnolia CMS

Уязвимость внедрения шаблонов на стороне сервера (SSTI) в формах регистрации и восстановления пароля Magnolia v6.2.3 и ниже позволяет неавторизованным злоумышленникам выполнять произвольный код с помощью специально созданной полезной нагрузки, введённой в параметр fullname.

Эта уязвимость была обнаружена в сотрудничестве с Марианом-Разваном Илисану.

Раскрытие и исправление этой уязвимости поставщиком можно найти здесь.

Более подробная информация и процесс эксплуатации описаны в этом PDF.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs in Magnolia CMS Expose Users to Remote Code Execution A series of vulnerabilities affecting Magnolia CMS versions 6.2.3 and below have been disclosed, including CVE-2021-46366, CVE-2021-46362, CVE-2021-46361, and CVE-2021-46364. These vulnerabilities allow unauthorized access and remote code execution through various attack vectors such as CSRF, server-side template injection, and YAML deserialization. The vulnerabilities were published on February 11, 2022, with proof-of-concept (PoC) code for CVE-2021-46364 released on November 24, 2023. Users of affected systems are at risk of credential theft and arbitrary code execution. Vendors have issued advisories for remediation, but the exploitation status varies across the CVEs. Security professionals are urged to apply patches and monitor for signs of exploitation. 4 sources 65

Extracted Entities

CVE-2021

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Platforms (2)