CVE-2022-23315: Malicious File Upload

Q: What is CVE-2022-23315?

CVE-2022-23315 is a vulnerability in MCMS v5.2.4 that allows arbitrary file uploads.

Q: How severe is CVE-2022-23315?

CVE-2022-23315 has a severity score of 9.8, which is considered critical.

Q: How does CVE-2022-23315 affect MCMS v5.2.4?

CVE-2022-23315 allows attackers to upload arbitrary files through the component `/ms/template/writeFileContent.do` in MCMS v5.2.4.

Q: What is the Common Weakness Enumeration (CWE) ID for CVE-2022-23315?

The CWE ID for CVE-2022-23315 is 434.

Q: Are there any references for CVE-2022-23315?

Yes, you can find more information about CVE-2022-23315 at the following references: [NIST](https://nvd.nist.gov/vuln/detail/CVE-2022-23315), [Gitee](https://web.archive.org/web/20220125060457/https://gitee.com/mingSoft/MCMS/issues/I4Q4PX), [GitHub](https://github.com/advisories/GHSA-fr5w-98mc-jjvg).

Published Jan 20, 2022

Updated

MCMS v5.2.4 was discovered to contain an arbitrary file upload vulnerability via the component /ms/template/writeFileContent.do.

Other sources

MCMS v5.2.4 was discovered to contain an arbitrary file upload vulnerability via the component /ms/template/writeFileContent.do.

Affected Software

2 affected components

maven/net.mingsoft:ms-mcms<=5.2.4

Mingsoft MCMS=5.2.4

Event History

Jan 20, 2022

CVE Published

via MITRE·11:40 PM

Data Sourced

via MITRE·11:40 PM

Description

Jan 22, 2022

Advisory Published

12:00 AM

Frequently Asked Questions

What is CVE-2022-23315?

CVE-2022-23315 is a vulnerability in MCMS v5.2.4 that allows arbitrary file uploads.

How severe is CVE-2022-23315?