Design/Logic Flaw

2021-12-0216:15:00

PRIOn knowledge base

www.prio-n.com

7.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.1%

JSON

Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage. The groovy script does not have security restrictions, which will cause attackers to execute arbitrary commands remotely(RCE).

CPENameOperatorVersion
crafter_cmsge3.1.0
crafter_cmslt3.1.12

CPE	Name	Operator	Version
	crafter_cms	ge	3.1.0
	crafter_cms	lt	3.1.12

References

docs.craftercms.org/en/3.1/security/advisory.html