CVE-2021-46364 Deserialization of Untrusted Data in Magnolia CMS

What is CVE-2021-46364?

CVE-2021-46364 is a high-severity unsafe deserialization vulnerability in n/a, published on 11 Feb 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

A vulnerability in the Snake YAML parser of Magnolia CMS v6.2.3 and below allows attackers to execute arbitrary code via a crafted YAML file.

Weakness: CWE-502

Which versions are affected by CVE-2021-46364?

2 open source packages ship an affected version, including info.magnolia:magnolia-core. It affects 1 product.

Products include Magnolia-Cms Magnolia Cms.

How do I fix CVE-2021-46364?

Upgrade info.magnolia:magnolia-core to 6.2.4 or later.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2021-46364 being exploited?

There is no known exploitation of CVE-2021-46364 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in n/a

• CVE-2021-46361 Arbitrary code execution in Magnolia CMS Critical 9.8
• CVE-2021-46362 Code injection in n/a Critical 9.8
• CVE-2021-46366 Cross-Site Request Forgery in Magnolia CMS High 8.8
• CVE-2021-46363 Arbitrary code execution in Magnolia CMS High 7.8
• CVE-2021-46365 Improper Restriction of XML External Entity Reference in Magnolia CMS High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pwr6-p3fh-grc2.