PT-2021-5585 · Unknown · Crafter Cms

Sparsh Kulshrestha · Published 2021-12-01 · Updated 2021-12-16 · CVE-2021-23264

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Crafter CMS (affected versions not specified)

Description The issue is related to security configuration errors in Crafter CMS. It allows remote attackers to create, view, and delete search indexes if crafter-search is not protected. This can be exploited by unauthenticated remote attackers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-402

CWE-668

Related Identifiers

BDU:2022-00015

CVE-2021-23264

GHSA-2WR2-8QJQ-GH55

Affected Products

Crafter Cms

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-23264 · Security Note
• https://osv.dev/vulnerability/GHSA-2wr2-8qjq-gh55 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00015 · Security Note
• https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2021120107 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-23264 · Vendor Advisory
• https://github.com/craftercms/craftercms/commit/0e256ef0372c7be9d6e2fefc4652dd4fd94770a1 · Note
• https://t.me/cibsecurity/33268 · Telegram Post
• https://t.me/cvenotify/24100 · Telegram Post