PT-2021-5603 · Unknown · Crafter Cms

Carlos Ortiz · Published 2021-12-01 · Updated 2022-08-30 · CVE-2021-23263

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Crafter CMS versions (affected versions not specified)

Description The issue allows unauthenticated remote attackers to read textual content via FreeMarker, including files in /scripts/, /templates/, and some non-binary files in /.git/*. This is related to security configuration errors in the content management system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-402

CWE-668

Related Identifiers

BDU:2022-00037

CVE-2021-23263

Affected Products

Crafter Cms

References · 7

• https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2021120106 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23263 · Security Note
• https://osv.dev/vulnerability/CVE-2021-23263 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00037 · Security Note
• https://t.me/cvenotify/35416 · Telegram Post
• https://t.me/cvenotify/24101 · Telegram Post
• https://t.me/cibsecurity/33263 · Telegram Post