Crafter Software

14 CVEs across 1 Crafter Software products. Browse Crafter Software vulnerabilities, severities, and proof-of-concept exploits.

Crafter Software products with known CVEs

ProductCVEs
Crafter Cms14
Crafter Software CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2022-40635Medium6.42022-09-13Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands vi…
CVE-2022-40634Medium6.42022-09-13Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands vi…
CVE-2021-23267High7.62022-05-16Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands vi…
CVE-2021-23266Medium4.32022-05-16An anonymous user can craft a URL with text that ends up in the log viewer as is. The text can then include textual messages to mislead the administrator.
CVE-2021-23265Low3.52022-05-16A logged-in and authenticated user with a Reviewer Role may lock a content item.
CVE-2021-23264High8.12021-12-02Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes.
CVE-2021-23263Medium5.92021-12-02Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/*, /templates/* and some of the files in /.git/* (non-binary).
CVE-2021-23262Medium4.22021-12-02Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE.
CVE-2021-23261Medium4.52021-12-02Authenticated administrators may override the system configuration file and cause a denial of service.
CVE-2021-23260Medium6.52021-12-02Authenticated users with Site roles may inject XSS scripts via file names that will execute in the browser for this and other users of the same site.
CVE-2021-23259Medium4.22021-12-02Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage. The groovy script…
CVE-2021-23258Medium4.22021-12-02Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SPEL Expression does not have security re…
CVE-2020-25803Medium4.22020-10-06Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands vi…
CVE-2020-25802Medium4.22020-10-06Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands vi…