CVE-2022-29647: 
Java vulnerability analysis and mitigation

There is a CSRF (Cross-Site Request Forgery) vulnerability in MCMS that can add an administrator account via ms/basic/manager/save.do. The vulnerability was assigned CVE-2022-29647 and was disclosed on June 2, 2022 (CISA Bulletin).

The vulnerability exists due to missing CSRF token validation when adding administrator users in the MCMS backend. When adding a user, the application does not implement proper token verification or referrer checking, making it vulnerable to CSRF attacks (GitHub POC).

An attacker can exploit this vulnerability to secretly add administrator users by tricking an authenticated administrator into visiting a specially crafted webpage. This allows the attacker to gain unauthorized administrative access to the MCMS backend system (GitHub POC).

The application should implement proper CSRF protection mechanisms including CSRF tokens and referrer validation when processing administrator user creation requests (GitHub POC).