# info.magnolia:magnolia-core (Maven) vulnerabilities

5 known vulnerabilities, with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://central.sonatype.com/artifact/info.magnolia/magnolia-core

## Advisories (5)

### [CVE-2021-46366](https://cve.now/CVE-2021-46366): An issue in the Login page of Magnolia CMS v6.2.3 and below allows attackers to exploit both an Open Redirect vulnerability and Cross-Site…

- Severity: Unrated
- Published: Feb 11, 2022
- Affected: fixed in 6.2.4.

### [CVE-2021-46365](https://cve.now/CVE-2021-46365): An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute XML External Entity attacks via a crafted XLF file.

- Severity: Unrated
- Published: Feb 11, 2022
- Affected: fixed in 6.2.4.

### [CVE-2021-46364](https://cve.now/CVE-2021-46364): A vulnerability in the Snake YAML parser of Magnolia CMS v6.2.3 and below allows attackers to execute arbitrary code via a crafted YAML…

- Severity: Unrated
- Published: Feb 11, 2022
- Affected: fixed in 6.2.4.

### [CVE-2021-46363](https://cve.now/CVE-2021-46363): An issue in the Export function of Magnolia v6.2.3 and below allows attackers to perform Formula Injection attacks via crafted CSV/XLS…

- Severity: Unrated
- Published: Feb 11, 2022
- Affected: fixed in 6.2.4.

### [CVE-2021-46361](https://cve.now/CVE-2021-46361): An issue in the Freemark Filter of Magnolia CMS v6.2.11 and below allows attackers to bypass security restrictions and execute arbitrary…

- Severity: Unrated
- Published: Feb 11, 2022
- Affected: fixed in 6.2.12.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/info.magnolia:magnolia-core
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.