CVE-2021-23263 Transmission of Private Resources into a New Sphere ('Resource Leak') in Crafter Engine
Unauthenticated attackers can read sensitive source code and configuration files from the server via FreeMarker template injection.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-23263?
CVE-2021-23263 is a medium-severity vulnerability in Crafter CMS, published on 2 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/*, /templates/* and some of the files in /.git/* (non-binary).
Which versions are affected by CVE-2021-23263?
It affects 1 product.
Products include Craftercms Crafter Cms.
How do I fix CVE-2021-23263?
No fix has been published for CVE-2021-23263 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-23263 being exploited?
There is no known exploitation of CVE-2021-23263 in the wild and no public exploit code.
Other vulnerabilities in Crafter CMS
- CVE-2017-15681 Path Traversal in Crafter CMS Crafter Studio
- CVE-2018-19907 OS Command Injection in craftercms:crafter-studio
- CVE-2017-15683 XML injection in Crafter CMS
- CVE-2017-15685 XML Injection in Crafter CMS Crafter Studio 3.0.1
- CVE-2021-23264 Exposure of Resource to Wrong Sphere in org.craftercms:crafter-search
Sources
Also known as GHSA-rg56-4qhp-cj7h.