High severityNVD Advisory· Published Oct 6, 2020· Updated Sep 16, 2024
Authenticated attackers with developer privileges in Crafter Studio may execute OS commands via deep inspection of FreeMarker template exposed objects.
CVE-2020-25803
Description
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker template exposed objects. This issue affects: Crafter Software Crafter CMS 3.0 versions prior to 3.0.27; 3.1 versions prior to 3.1.7.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.craftercms:crafter-studioMaven | >= 3.0, < 3.0.27 | 3.0.27 |
org.craftercms:crafter-studioMaven | >= 3.1, < 3.1.7 | 3.1.7 |
Affected products
2- Range: 3.0
Patches
Vulnerability mechanics
References
3- github.com/advisories/GHSA-8786-wg74-f522ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2020-25803ghsaADVISORY
- docs.craftercms.org/en/3.1/security/advisory.htmlghsax_refsource_MISCWEB
News mentions
0No linked articles in our index yet.