CVE-2021-23262

Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE.

Score

CVSS 3.1 7.2 High

Status

Modified - security@craftersoftware.com

Published

2021-12-02

Last modified

2024-09-16

Weaknesses

CWE-913

Affected products

• Crafter Cms (Crafter Software)
• Crafter Cms (Craftercms)

References

• https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2021120105