CVE-2017-15682
MediumCVSS 6.1Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker can inject malicious JavaScript code, leading to stored/blind XSS in the admin panel.
Risk Assessment
An attacker could steal admin sessions, modify content, or take over the admin panel, compromising the confidentiality and integrity of the system.
Recommendation
Immediately upgrade Crafter CMS to a patched version and implement input validation and output encoding for user-supplied data.
Other vulnerabilities in Crafter CMS
See all- CVE-2017-15681Critical
In Crafter CMS Crafter Studio 3.0.1, a directory traversal vulnerability exists that allows unauthenticated attackers to overwrite operating system files, potentially leading to remote code execution (RCE).
- CVE-2017-15685High
Crafter CMS Crafter Studio 3.0.1 is affected by an XML External Entity (XXE) vulnerability. An unauthenticated attacker can create a site with specially crafted XML, allowing out-of-band retrieval of OS files.
- CVE-2017-15684High
Crafter CMS Crafter Studio 3.0.1 contains a directory traversal vulnerability that allows unauthenticated attackers to view files from the operating system.
- CVE-2017-15683High
In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker can create a site with specially crafted XML, allowing out-of-band retrieval of OS files.
- CVE-2017-15680Medium
In Crafter CMS Crafter Studio 3.0.1 an IDOR vulnerability exists which allows unauthenticated attackers to view and modify administrative data.
Original NVD description (English source)
In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to inject malicious JavaScript code resulting in a stored/blind XSS in the admin panel.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS