Lucene search

GitHub Advisory DatabaseGHSA-2RR8-9C6G-8J5C

HistoryMay 24, 2022 - 5:34 p.m.

Missing Authorization in Crafter CMS

2022-05-2417:34:59

CWE-862

GitHub Advisory Database

github.com

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

35.0%

JSON

In Crafter CMS Crafter Studio 3.0 prior to 3.0.1 an IDOR vulnerability exists which allows unauthenticated attackers to view and modify administrative data.

Affected configurations

Vulners

Node

org.craftercms\crafterMatchcore

CPENameOperatorVersion
org.craftercms:crafter-corelt3.0.1

CPE	Name	Operator	Version
	org.craftercms:crafter-core	lt	3.0.1

References

docs.craftercms.org/en/3.0/security/advisory.html

github.com/advisories/GHSA-2rr8-9c6g-8j5c

nvd.nist.gov/vuln/detail/CVE-2017-15680

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

35.0%

JSON

Related for GHSA-2RR8-9C6G-8J5C