Crafter Software

11 results · Clear filters · Feed

• Medium 6.4
  CVE-2022-40635 Public exploit

  Improper Control of Dynamically-Managed Code Resources in Crafter Studio

  Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass.

  Crafter Software Crafter CMS org.craftercms:craftercms Maven
  Sep 13, 2022
• Medium 6.4
  CVE-2022-40634 Public exploit

  Improper Control of Dynamically-Managed Code Resources in Crafter Studio

  Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker SSTI.

  Crafter Software Crafter CMS org.craftercms:crafter-studio Maven
  Sep 13, 2022
• Medium 4.3
  CVE-2021-23266

  Improper Output Neutralization for Logs in Crafter Studio

  An anonymous user can craft a URL with text that ends up in the log viewer as is. The text can then include textual messages to mislead the administrator.

  Crafter Software Crafter CMS org.craftercms:craftercms Maven
  May 16, 2022
• Medium 5.9
  CVE-2021-23263

  Transmission of Private Resources into a New Sphere ('Resource Leak') in Crafter Engine

  Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/*, /templates/* and some of the files in /.git/* (non-binary).

  Crafter Software Crafter CMS
  Dec 2, 2021
• Medium 4.2
  CVE-2021-23262

  Snakeyaml deserialization vulnerability bypass

  Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE.

  Crafter Software Crafter CMS
  Dec 2, 2021
• Medium 6.5
  CVE-2021-23260

  Stored XSS Vulnerability in File Name of the File Upload function

  Authenticated users with Site roles may inject XSS scripts via file names that will execute in the browser for this and other users of the same site.

  Crafter Software Crafter CMS
  Dec 2, 2021
• Medium 4.5
  CVE-2021-23261

  Overriding the system configuration file causes a denial of service

  Authenticated administrators may override the system configuration file and cause a denial of service.

  Crafter Software Crafter CMS
  Dec 2, 2021
• Medium 4.2
  CVE-2021-23259

  Groovy Sandbox Bypass

  Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage. The groovy script does not have security restrictions, which will cause attackers to execute arbitrary commands remot…

  Crafter Software Crafter CMS
  Dec 2, 2021
• Medium 4.2
  CVE-2021-23258

  Spring SPEL Expression Language Injection

  Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SPEL Expression does not have security restrictions, which will cause attackers to execute arbitrary commands remotely (RCE).

  Crafter Software Crafter CMS
  Dec 2, 2021
• Medium 4.2
  CVE-2020-25803

  Authenticated attackers with developer privileges in Crafter Studio may execute OS commands via deep inspection of FreeMarker template exposed objects.

  Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker template exposed objects. This issue affects: Crafter Software Crafter CMS 3.0 versions…

  Crafter Software Crafter CMS org.craftercms:crafter-studio Maven
  Oct 6, 2020
• Medium 4.2
  CVE-2020-25802

  Authenticated attackers with developer privileges in Crafter Studio may execute OS commands via Groovy scripting.

  Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy scripting. This issue affects: Crafter Software Crafter CMS 3.0 versions prior to 3.0.27; 3…

  Crafter Software Crafter CMS org.craftercms:crafter-studio Maven
  Oct 6, 2020