Craftercms CVE-2021-23263

HIGH

Transmission of Private Resources into a New Sphere ('Resource Leak') (CWE-402)

2021-12-02 security@craftersoftware.com

Information Disclosure Craftercms Crafter Cms

7.5

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

1

CVE Published

Dec 02, 2021 - 16:15 nvd

HIGH 7.5

DescriptionNVD

Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/*, /templates/* and some of the files in /.git/* (non-binary).

AnalysisAI

Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/*, /templates/* and some of the files in /.git/* (non-binary). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-402. Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/*, /templates/* and some of the files in /.git/* (non-binary). Affected products include: Craftercms Crafter Cms.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Craftercms

View all

CVE-2018-19907 HIGH This Week POC

A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18. Rated high severity (CVSS 8.8), this vulner

CVE-2017-15681 CRITICAL Act Now

In Crafter CMS Crafter Studio 3.0.1 a directory traversal vulnerability exists which allows unauthenticated attackers to

CVE-2023-4136 MEDIUM This Month POC

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine

CVE-2025-6384 CRITICAL Act Now

Critical Remote Code Execution vulnerability in CrafterCMS Crafter Studio that allows authenticated developers to bypass

CVE-2021-23264 CRITICAL Act Now

Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete

CVE-2017-15685 HIGH This Week

Crafter CMS Crafter Studio 3.0.1 is affected by: XML External Entity (XXE). Rated high severity (CVSS 8.6), this vulnera

CVE-2017-15683 HIGH This Week

In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to create a site with specially crafted XML that

CVE-2023-33194 MEDIUM This Month POC

Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output i

CVE-2017-15684 HIGH This Week

Crafter CMS Crafter Studio 3.0.1 has a directory traversal vulnerability which allows unauthenticated attackers to view

CVE-2023-26020 HIGH This Week

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crafter Studio on

CVE-2022-40635 HIGH This Week

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticat

CVE-2022-40634 HIGH This Week

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticat

Same weakness CWE-402 – Transmission of Private Resources into a New Sphere ('Resource Leak')

View all

CVE-2025-29925 HIGH POC

CVE-2023-34467 HIGH POC

CVE-2021-23264 CRITICAL

CVE-2025-66422 MEDIUM POC

CVE-2023-38509 MEDIUM POC

CVE-2024-29900 HIGH

CVE-2021-31410 HIGH

CVE-2021-31407 HIGH

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

CVE-2021-34523 CRITICAL POC

CVE-2013-2251 CRITICAL POC

CVE-2017-5638 CRITICAL POC

CVE-2025-24813 CRITICAL POC

CVE-2015-1701 HIGH POC

CVE-2017-0147 HIGH POC

CVE-2014-6324 HIGH POC

Share

CVE-2021-23263 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy