CVE-2021-46116: Malicious File Upload
jpress 4.2.0 is vulnerable to remote code execution via io.jpress.web.admin.TemplateController#doInstall. The admin panel provides a function through which attackers can install templates and inject some malicious code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
jpressto a version that resolves this vulnerability.Fixed in 4.2.0 - Compensating control
Restrict access to the admin panel/template installation function (io.jpress.web.admin._TemplateController#doInstall) to trusted users/hosts (e.g., via network ACL/firewall or IP allowlisting) until the vulnerability is remediated.
Event History
Frequently Asked Questions
What is the severity of CVE-2021-46116?
CVE-2021-46116 is classified as a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2021-46116?
To remediate CVE-2021-46116, upgrading JPress to a version beyond 4.2.0 is recommended as it addresses the remote code execution flaw.
What type of vulnerability is CVE-2021-46116?
CVE-2021-46116 is a remote code execution vulnerability found in JPress 4.2.0.
Who is affected by CVE-2021-46116?
The vulnerability affects users of JPress version 4.2.0, particularly those with access to the admin panel.
What can attackers do with CVE-2021-46116?
Attackers can exploit CVE-2021-46116 to inject malicious code through the template installation process in the admin panel.