Skip to content
CVE PROGRAM SOURCE RECORD4.2 Medium

CVE-2020-25802

Authenticated attackers with developer privileges in Crafter Studio may execute OS commands via Groovy scripting.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
crafter

Description

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy scripting. This issue affects: Crafter Software Crafter CMS 3.0 versions prior to 3.0.27; 3.1 versions prior to 3.1.7.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Crafter Software Crafter CMS

  • 3.0 to < 3.0.27affected
  • 3.1 to < 3.1.7affected

References