CVE-2017-15684
HighCVSS 7.5Exploitation Probability (EPSS)
High risk78th percentile - higher than 78% of all known CVEs
Summary
Crafter CMS Crafter Studio 3.0.1 contains a directory traversal vulnerability that allows unauthenticated attackers to view files from the operating system.
Risk Assessment
The risk involves unauthorized access to sensitive system files, potentially leading to data leakage or further attack escalation.
Recommendation
It is recommended to immediately upgrade Crafter CMS to a version where this vulnerability is fixed and restrict access to the Crafter Studio interface to trusted networks only.
Other vulnerabilities in Crafter CMS
See all- CVE-2017-15681Critical
In Crafter CMS Crafter Studio 3.0.1, a directory traversal vulnerability exists that allows unauthenticated attackers to overwrite operating system files, potentially leading to remote code execution (RCE).
- CVE-2017-15685High
Crafter CMS Crafter Studio 3.0.1 is affected by an XML External Entity (XXE) vulnerability. An unauthenticated attacker can create a site with specially crafted XML, allowing out-of-band retrieval of OS files.
- CVE-2017-15683High
In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker can create a site with specially crafted XML, allowing out-of-band retrieval of OS files.
- CVE-2017-15682Medium
In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker can inject malicious JavaScript code, leading to stored/blind XSS in the admin panel.
- CVE-2017-15680Medium
In Crafter CMS Crafter Studio 3.0.1 an IDOR vulnerability exists which allows unauthenticated attackers to view and modify administrative data.
Original NVD description (English source)
Crafter CMS Crafter Studio 3.0.1 has a directory traversal vulnerability which allows unauthenticated attackers to view files from the operating system.