CVE-2017-15680
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
In Crafter CMS Crafter Studio 3.0.1 an IDOR vulnerability exists which allows unauthenticated attackers to view and modify administrative data.
Risk Assessment
The risk involves unauthorized access to sensitive administrative data and its modification, potentially leading to full compromise of the CMS system.
Recommendation
Immediately upgrade Crafter CMS to a patched version and implement access control mechanisms for all administrative resources.
Other vulnerabilities in Crafter CMS
See all- CVE-2017-15681Critical
In Crafter CMS Crafter Studio 3.0.1, a directory traversal vulnerability exists that allows unauthenticated attackers to overwrite operating system files, potentially leading to remote code execution (RCE).
- CVE-2017-15685High
Crafter CMS Crafter Studio 3.0.1 is affected by an XML External Entity (XXE) vulnerability. An unauthenticated attacker can create a site with specially crafted XML, allowing out-of-band retrieval of OS files.
- CVE-2017-15684High
Crafter CMS Crafter Studio 3.0.1 contains a directory traversal vulnerability that allows unauthenticated attackers to view files from the operating system.
- CVE-2017-15683High
In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker can create a site with specially crafted XML, allowing out-of-band retrieval of OS files.
- CVE-2017-15682Medium
In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker can inject malicious JavaScript code, leading to stored/blind XSS in the admin panel.
Original NVD description (English source)
In Crafter CMS Crafter Studio 3.0.1 an IDOR vulnerability exists which allows unauthenticated attackers to view and modify administrative data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS