CVE-2021-44978: Code Injection
Published Feb 4, 2022
·Updated
iCMS <= 8.0.0 allows users to add and render a comtom template, which has a SSTI vulnerability which causes remote code execution.
Affected Software
1 affected component
idreamsoft iCMS<=8.0.0
Event History
Feb 4, 2022
CVE Published
via MITRE·03:29 PM
Data Sourced
via MITRE·03:29 PM
Description
Frequently Asked Questions
1
What is CVE-2021-44978?
CVE-2021-44978 is a vulnerability in iCMS <= 8.0.0 that allows users to add and render a custom template with Server-Side Template Injection (SSTI) vulnerability, leading to remote code execution.
2
What is the severity of CVE-2021-44978?
The severity of CVE-2021-44978 is critical, with a severity value of 9.8.
3
What software is affected by CVE-2021-44978?
iCMS <= 8.0.0 is affected by CVE-2021-44978.
4
How does CVE-2021-44978 work?
CVE-2021-44978 allows users to add and render a custom template with SSTI vulnerability, which can be exploited to execute remote code.
5
How can I fix CVE-2021-44978?
To fix CVE-2021-44978, update iCMS to a version higher than 8.0.0 and ensure custom templates are secure.