CVE-2017-15681
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk79th percentile - higher than 79% of all known CVEs
Summary
In Crafter CMS Crafter Studio 3.0.1, a directory traversal vulnerability exists that allows unauthenticated attackers to overwrite operating system files, potentially leading to remote code execution (RCE).
Risk Assessment
The risk for the organization includes the possibility of an unauthenticated attacker gaining full control over the server, which could result in data loss, service disruption, or further attacks on the infrastructure.
Recommendation
It is recommended to immediately upgrade Crafter CMS to a version that fixes this vulnerability and restrict access to the Crafter Studio interface to trusted networks only.
Other vulnerabilities in Crafter CMS
See all- CVE-2017-15685High
Crafter CMS Crafter Studio 3.0.1 is affected by an XML External Entity (XXE) vulnerability. An unauthenticated attacker can create a site with specially crafted XML, allowing out-of-band retrieval of OS files.
- CVE-2017-15684High
Crafter CMS Crafter Studio 3.0.1 contains a directory traversal vulnerability that allows unauthenticated attackers to view files from the operating system.
- CVE-2017-15683High
In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker can create a site with specially crafted XML, allowing out-of-band retrieval of OS files.
- CVE-2017-15682Medium
In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker can inject malicious JavaScript code, leading to stored/blind XSS in the admin panel.
- CVE-2017-15680Medium
In Crafter CMS Crafter Studio 3.0.1 an IDOR vulnerability exists which allows unauthenticated attackers to view and modify administrative data.
Original NVD description (English source)
In Crafter CMS Crafter Studio 3.0.1 a directory traversal vulnerability exists which allows unauthenticated attackers to overwrite files from the operating system which can lead to RCE.