CVE-2021-46364: 
Java vulnerability analysis and mitigation

A vulnerability in the Snake YAML parser of Magnolia CMS v6.2.3 and below allows attackers to execute arbitrary code via a crafted YAML file. The vulnerability was disclosed and fixed in Magnolia CMS 6.2.4, released on November 12, 2020. This vulnerability is tracked as CVE-2021-46364 (NVD, Magnolia Release Notes).

The vulnerability exists in the Snake YAML parser implementation which is susceptible to deserialization attacks. The flaw allows attackers to call arbitrary Java constructors when importing YAML files. The vulnerability has been assigned a CVSS v3.1 Base Score of 7.8 HIGH (Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) (NVD).

Successful exploitation of this vulnerability can lead to Remote Code Execution (RCE) on the affected system. An attacker can execute arbitrary code with the privileges of the application, potentially leading to complete system compromise (GitHub Disclosure).

The vulnerability has been fixed in Magnolia CMS version 6.2.4. Users are advised to upgrade to this version or later to mitigate the risk. The fix was part of several security updates addressing various vulnerabilities including deserialization attacks (Magnolia Release Notes).