CVE-2021-23259

Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage. The groovy script does not have security restrictions, which will cause attackers to execute arbitrary commands remotely(RCE).

Link	Resource
https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2021120102	Vendor Advisory

Configuration 1

cpe:2.3:a:craftercms:crafter_cms:*:*:*:*:*:*:*:*

---

Published : 2021-12-02 04:15

Updated : 2021-12-03 02:28

---

NVD link : CVE-2021-23259

Mitre link : CVE-2021-23259

No products.

CWE-913