Login Request a demo
CC
Product
Crafter Cms
by Craftercms · last CVE Feb 17, 2023
21
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities21In the news0Timeline
Severity mix
Critical 2High 12Medium 7Low 0
Severity
All severities21Critical2High12Medium7Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Crafter Cms to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2021-23267
8.8
1%
May 16
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker static…
Affected: 3.1 before 3.1.18
CVE-2018-19907
8.8
2%
Dec 6
A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18
Affected: through 3.0.18
CVE-2017-15685
8.6
2%
Nov 27
Crafter CMS Crafter Studio 3.0.1 is affected by: XML External Entity (XXE)
Affected: 3.0.0 before 3.0.1
CVE-2017-15683
8.6
2%
Nov 27
In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band
Affected: 3.0.0 before 3.0.1
CVE-2021-23263
7.5
2%
Dec 2
Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/*, /templates/* and some of the files in /.git/* (non-binary)
Affected: 3.1.0 before 3.1.15
CVE-2017-15684
7.5
2%
Nov 27
Crafter CMS Crafter Studio 3.0.1 has a directory traversal vulnerability which allows unauthenticated attackers to view files from the operating system
Affected: 3.0.0 before 3.0.1
CVE-2023-26020
7.2
0%
Feb 17
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crafter Studio on Linux, MacOS, Windows, x86, ARM, 64 bit allows SQL…
Affected: 3.1.0 through 3.1.26; 4.0.0 through 4.0.1
CVE-2022-40635
7.2
2%
Sep 13
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox…
Affected: 3.1.0 before 3.1.23
CVE-2022-40634
7.2
2%
Sep 13
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker SSTI
Affected: 3.1.0 before 3.1.23
CVE-2021-23262
7.2
1%
Dec 2
Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE
Affected: 3.1.0 before 3.1.13
CVE-2021-23259
7.2
1%
Dec 2
Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage
Affected: 3.1.0 before 3.1.12
CVE-2021-23258
7.2
1%
Dec 2
Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans
Affected: 3.1.0 before 3.1.12
Showing 12