Lucene search
CrafterCVELIST:CVE-2021-23259HistoryDec 02, 2021 - 3:40 p.m.
CVE-2021-23259 Groovy Sandbox Bypass
2021-12-0215:40:55
CWE-913
crafter
www.cve.org
4
cve-2021-23259
groovy
sandbox
bypass
authenticated users
administrator
developer
os commands
groovy script
webpage
security restrictions
attackers
remote code execution
rce
CVSS3
4.2
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H
EPSS
0.001
Percentile
42.0%
Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage. The groovy script does not have security restrictions, which will cause attackers to execute arbitrary commands remotely(RCE).
CNA Affected
[
{
"product": "Crafter CMS",
"vendor": "Crafter Software",
"versions": [
{
"lessThan": "3.1.12",
"status": "affected",
"version": "3.1",
"versionType": "custom"
}
]
}
]Related
cnvd
cnvd
Crafter CMS Access Control Error Vulnerability
2021-12-04 00:00:00
prion
prion
Design/Logic Flaw
2021-12-02 16:15:00
osv
osv
CVE-2021-23259
2021-12-02 16:15:07
nvd
nvd
CVE-2021-23259
2021-12-02 16:15:07
cve
cve
CVE-2021-23259
2021-12-02 16:15:07
CVSS3
4.2
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H
EPSS
0.001
Percentile
42.0%
Related for CVELIST:CVE-2021-23259