TI-2021-06003 Aliases CVE-2021-23263 GHSA-rg56-4qhp-cj7h

Transmission of Private Resources into a New Sphere ('Resource Leak') in Crafter Engine

LOW 36CWE-402Published 2021-12-02 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-668 and the CVSS impact.

Summary

Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/*, /templates/* and some of the files in /.git/* (non-binary).

Why it matters now

EPSS 0.017 77th percentileScored 2026-11-07

Fix Fixed Crafter CMS (Crafter Software): 3.1.15

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Crafter Software	Crafter CMS	3.1 to before 3.1.15	3.1.15	Patch available	CNA

Crafter CMS VendorCrafter Software Affected 3.1 to before 3.1.15 Fixed in 3.1.15 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:craftercms:crafter_cms::::::::	3.1.0 to before 3.1.15	Vulnerable	Crafter Software

cpe:2.3:a:craftercms:crafter_cms:*:*:*:*:*:*:*:* Versions 3.1.0 to before 3.1.15 Vulnerable ·Crafter Software

Remediation

Fix · CNA Crafter CMS (Crafter Software) Fixed in 3.1.15

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2021-12-02
Crafter CMS 3.1.15
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2021-06004 Exposure of resource to wrong sphere in Crafter CMSPriority MEDIUM 42
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2021-23263
2026-10-03 Alias added: GHSA-rg56-4qhp-cj7h

References

Advisory 1

https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2021120106

TI-2017-11458 In Crafter CMS Crafter Studio 3.0.1 a directory traversal vulnerability exists which… CVSS 3.1CRITICAL 9.8
TI-2021-06004 Exposure of resource to wrong sphere in Crafter CMS CVSS 3.1CRITICAL 9.1
TI-2018-14105 A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18. CVSS 3.0HIGH 8.8
TI-2017-11462 Crafter CMS Crafter Studio 3.0.1 is affected by: XML External Entity (XXE). CVSS 3.1HIGH 8.6
TI-2021-06007 Improper Control of Dynamically-Managed Code Resources in Crafter Studio CVSS 3.1HIGH 8.8
TI-2017-11460 In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to create a site… CVSS 3.1HIGH 8.6

See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences