Cross-site Scripting (XSS)

Overview org.craftercms:crafter-engine is a Crafter Content Delivery Engine. Affected versions of this package are vulnerable to Cross-site Scripting XSS via API endpoints that reflect some input parameter and do produce XML responses. An attacker can inject malicious scripts by sending crafted...

org.craftercms:crafter-studio (>=3.0.0, <=3.1.27e) potentially affected by CVE-2023-4136 via org.craftercms:crafter-engine (>=3.0.0, <=3.1.27e)

org.craftercms:crafter-engine MAVEN version =3.0.0, =3.0.0, =3.1.27e Source cves: CVE-2023-4136 Source advisory: SNYK:JAVA-ORGCRAFTERCMS-8722255...

org.craftercms:crafter-studio (>=3.1.0, <=3.1.27e) potentially affected by CVE-2023-4136 via org.craftercms:crafter-engine (>=3.1.0, <=3.1.27e)

org.craftercms:crafter-engine MAVEN version =3.1.0, =3.1.0, =3.1.27e Source cves: CVE-2023-4136 Source advisory: OSV:GHSA-JFM4-3VV3-FM4V...

org.craftercms:crafter-studio (>=3.1.0, <=3.1.27e) potentially affected by CVE-2023-4136 via org.craftercms:crafter-engine (>=3.1.0, <=3.1.27e)

org.craftercms:crafter-engine MAVEN version =3.1.0, =3.1.0, =3.1.27e Source cves: CVE-2023-4136 Source advisory: GHSA-JFM4-3VV3-FM4V...

org.craftercms:crafter-studio (>=4.0.1, <=4.0.2) potentially affected by CVE-2023-4136 via org.craftercms:crafter-engine (>=4.0.1, <=4.0.2)

org.craftercms:crafter-engine MAVEN version =4.0.1, =4.0.1, =4.0.2 Source cves: CVE-2023-4136 Source advisory: OSV:GHSA-JFM4-3VV3-FM4V...

org.craftercms:crafter-studio (>=4.0.1, <=4.0.2) potentially affected by CVE-2023-4136 via org.craftercms:crafter-engine (>=4.0.1, <=4.0.2)

org.craftercms:crafter-engine MAVEN version =4.0.1, =4.0.1, =4.0.2 Source cves: CVE-2023-4136 Source advisory: GHSA-JFM4-3VV3-FM4V...

org.craftercms:crafter-studio (>=4.0.1, <=4.0.2) potentially affected by CVE-2023-4136 via org.craftercms:crafter-engine (>=4.0.1, <=4.0.2)

org.craftercms:crafter-engine MAVEN version =4.0.1, =4.0.1, =4.0.2 Source cves: CVE-2023-4136 Source advisory: SNYK:JAVA-ORGCRAFTERCMS-8722255...

org.craftercms:crafter-studio (>=3.1.0, <=3.1.27e) potentially affected by CVE-2023-4136 via org.craftercms:crafter-engine (>=3.1.0, <=3.1.27e)

org.craftercms:crafter-engine MAVEN version =3.1.0, =3.1.0, =3.1.27e Source cves: CVE-2023-4136 Source advisory: MEND:CVE-2023-4136...

org.apache.skywalking:graphql-16plus-plugin (>=8.10.0, <=9.6.0), org.craftercms:crafter-engine (>=3.1.25, <=3.1.29e) potentially affected by CVE-2022-37734 via com.graphql-java:graphql-java (16.0)

com.graphql-java:graphql-java MAVEN version 16.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - org.apache.skywalking:graphql-16plus-plugin =8.10.0, =3.1.25, =3.1.29e Source cves: CVE-2022-37734...

org.craftercms:crafter-deployer (3.0.0), org.craftercms:crafter-engine (3.0.0) +1 more potentially affected by CVE-2017-15682 via org.craftercms:crafter-core (3.0.0)

org.craftercms:crafter-core MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.craftercms:crafter-core and may be impacted: - org.craftercms:crafter-deployer 3.0.0 - org.craftercms:crafter-engine 3.0.0 -...

org.craftercms:crafter-deployer (3.0.0), org.craftercms:crafter-engine (3.0.0) +1 more potentially affected by CVE-2017-15683 via org.craftercms:crafter-core (3.0.0)

org.craftercms:crafter-core MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.craftercms:crafter-core and may be impacted: - org.craftercms:crafter-deployer 3.0.0 - org.craftercms:crafter-engine 3.0.0 -...

org.craftercms:crafter-deployer (3.0.0), org.craftercms:crafter-engine (3.0.0) +1 more potentially affected by CVE-2017-15680 via org.craftercms:crafter-core (3.0.0)

org.craftercms:crafter-core MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.craftercms:crafter-core and may be impacted: - org.craftercms:crafter-deployer 3.0.0 - org.craftercms:crafter-engine 3.0.0 -...

org.craftercms:crafter-deployer (3.0.0), org.craftercms:crafter-engine (3.0.0) +1 more potentially affected by CVE-2017-15683 via org.craftercms:crafter-core (3.0.0)

org.craftercms:crafter-core MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.craftercms:crafter-core and may be impacted: - org.craftercms:crafter-deployer 3.0.0 - org.craftercms:crafter-engine 3.0.0 -...

CVE-2021-23263 Transmission of Private Resources into a New Sphere ('Resource Leak') in Crafter Engine

Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/, /templates/ and some of the files in /.git/ non-binary...

org.craftercms:crafter-deployer (3.0.0), org.craftercms:crafter-engine (3.0.0) +1 more potentially affected by CVE-2017-15680 via org.craftercms:crafter-core (3.0.0)

org.craftercms:crafter-core MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.craftercms:crafter-core and may be impacted: - org.craftercms:crafter-deployer 3.0.0 - org.craftercms:crafter-engine 3.0.0 -...

org.craftercms:crafter-deployer (3.0.0), org.craftercms:crafter-engine (3.0.0) +1 more potentially affected by CVE-2017-15682 via org.craftercms:crafter-core (3.0.0)

org.craftercms:crafter-core MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.craftercms:crafter-core and may be impacted: - org.craftercms:crafter-deployer 3.0.0 - org.craftercms:crafter-engine 3.0.0 -...

org.craftercms:crafter-deployer (3.0.0), org.craftercms:crafter-engine (3.0.0) +1 more potentially affected by CVE-2017-15683 via org.craftercms:crafter-core (3.0.0)

org.craftercms:crafter-core MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.craftercms:crafter-core and may be impacted: - org.craftercms:crafter-deployer 3.0.0 - org.craftercms:crafter-engine 3.0.0 -...