CVE-2021-28940: Critical severity magpierss vulnerability

Published Apr 2, 2021

Updated

Because of a incorrect escaped exec command in MagpieRSS in 0.72 in the /extlib/Snoopy.class.inc file, it is possible to add a extra command to the curl binary. This creates an issue on the /scripts/magpiedebug.php and /scripts/magpiesimple.php page that if you send a specific https url in the RSS URL field, you are able to execute arbitrary commands.

Affected Software

1 affected component

Magpierss Project Magpierss=0.72

Event History

Apr 2, 2021

CVE Published

via MITRE·07:06 PM

Data Sourced

via MITRE·07:06 PM

Description

Frequently Asked Questions

What is the severity of CVE-2021-28940?

CVE-2021-28940 has been classified with a moderate severity level due to the potential for command injection.

How do I fix CVE-2021-28940?

To mitigate CVE-2021-28940, update to the latest version of MagpieRSS that has addressed this vulnerability.

What are the affected versions for CVE-2021-28940?

CVE-2021-28940 specifically affects MagpieRSS version 0.72.

What could be the impact of CVE-2021-28940?

CVE-2021-28940 could allow an attacker to execute arbitrary commands on the server by injecting commands through crafted URLs.

Where is CVE-2021-28940 found in the code?

CVE-2021-28940 is due to an incorrect escaped exec command located in the /extlib/Snoopy.class.inc file.