CVE-2022-22930
Published: 21 January 2022
Summary
CVE-2022-22930 is a critical-severity an unspecified weakness vulnerability in Mingsoft Mcms. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 6.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A remote code execution vulnerability tracked as CVE-2022-22930 affects the Template Management function in MCMS version 5.2.4. The flaw permits an attacker to supply a crafted payload that results in arbitrary code execution on the server. It received a CVSS 3.1 base score of 9.8, reflecting network-accessible attack vectors that require no authentication or user interaction.
Unauthenticated remote attackers can exploit the issue over the network to achieve full compromise of confidentiality, integrity, and availability on affected MCMS instances. The published description indicates that successful exploitation grants the ability to run attacker-chosen code within the context of the application.
The EPSS score for this CVE has remained flat at 0.1072 with no material increase since disclosure. The two listed references both point to the same Gitee issue thread for MCMS, which contains the original vulnerability report.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-0534
Vulnerability details
A remote code execution (RCE) vulnerability in the Template Management function of MCMS v5.2.4 allows attackers to execute arbitrary code via a crafted payload.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.