CVE-2021-23258

Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SPEL Expression does not have security restrictions, which will cause attackers to execute arbitrary commands remotely RCE...

CVE-2021-23259

Crafter CMS vulnerability CVE-2021-23259 allows authenticated users with Administrator or Developer roles to execute OS commands via a Groovy Script that renders pages. The root cause is Groovy script execution without security restrictions, enabling remote command execution (RCE). This is descri...

CVE-2021-23258

The CVE-2021-23258 entry refers to a Crafter CMS expression injection vulnerability where an authenticated Administrator or Developer could abuse an unrestricted SPEL Expression in Spring beans to execute OS commands (RCE). Root cause: SPEL expressions are not secured, enabling remote code execut...