Medium · 5.9 CVE-2021-23263 EUVD-2021-10362GHSA-rg56-4qhp-cj7h

Transmission of Private Resources into a New Sphere ('Resource Leak') in Crafter Engine

Published Dec 2, 2021 · Updated Sep 16, 2024 · Assigned by crafter

Vendor: Crafter Software Product: Crafter CMS

Description

Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/*, /templates/* and some of the files in /.git/* (non-binary).

Affected products

Vendor	Product	Affected	Fixed
Crafter Software	Crafter CMS	3.1 – < 3.1.15	3.1.15

References

https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2021120106