Description
Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Crafter Software | Crafter CMS | 3.1 – < 3.1.13 | 3.1.13 |
Medium · 4.2
CVE-2021-23262
EUVD-2021-10361GHSA-v5x7-7m6q-5hvf
Snakeyaml deserialization vulnerability bypass
Published Dec 2, 2021 · Updated Sep 16, 2024 · Assigned by crafter