Crafter Software Crafter Cms
14 CVEs affecting Crafter Software Crafter Cms. Latest disclosed: 2022-09-13. Critical: 0, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-23264 | High | 8.1 | 2021-12-02 | Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes. |
CVE-2021-23267 | High | 7.6 | 2022-05-16 | Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands vi… |
CVE-2021-23260 | Medium | 6.5 | 2021-12-02 | Authenticated users with Site roles may inject XSS scripts via file names that will execute in the browser for this and other users of the same site. |
CVE-2022-40635 | Medium | 6.4 | 2022-09-13 | Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands vi… |
CVE-2022-40634 | Medium | 6.4 | 2022-09-13 | Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands vi… |
CVE-2021-23263 | Medium | 5.9 | 2021-12-02 | Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/*, /templates/* and some of the files in /.git/* (non-binary). |
CVE-2021-23261 | Medium | 4.5 | 2021-12-02 | Authenticated administrators may override the system configuration file and cause a denial of service. |
CVE-2021-23266 | Medium | 4.3 | 2022-05-16 | An anonymous user can craft a URL with text that ends up in the log viewer as is. The text can then include textual messages to mislead the administrator. |
CVE-2021-23262 | Medium | 4.2 | 2021-12-02 | Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE. |
CVE-2021-23259 | Medium | 4.2 | 2021-12-02 | Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage. The groovy script… |
CVE-2021-23258 | Medium | 4.2 | 2021-12-02 | Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SPEL Expression does not have security re… |
CVE-2020-25803 | Medium | 4.2 | 2020-10-06 | Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands vi… |
CVE-2020-25802 | Medium | 4.2 | 2020-10-06 | Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands vi… |
CVE-2021-23265 | Low | 3.5 | 2022-05-16 | A logged-in and authenticated user with a Reviewer Role may lock a content item. |