Code injection

2022-05-1617:15:00

PRIOn knowledge base

www.prio-n.com

4.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.5%

JSON

An anonymous user can craft a URL with text that ends up in the log viewer as is. The text can then include textual messages to mislead the administrator.

CPENameOperatorVersion
crafter_cmsge3.1
crafter_cmslt3.1.18

CPE	Name	Operator	Version
	crafter_cms	ge	3.1
	crafter_cms	lt	3.1.18

References

docs.craftercms.org/en/3.1/security/advisory.html