CVE-2017-15683

Published: Nov 27, 2020Modified: Jul 9, 2026

8.6

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 4.0

Source: NVD

Description

In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band.

Affected (1)

Products: Craftercms: Crafter Cms

Craftercms

1 product

Crafter Cms

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Craftercms Crafter Cms	From 3.0.0 to 3.0.1

Related CWEs

CWE-91

XML Injection (aka Blind XPath Injection)

The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

References (2)

https://docs.craftercms.org/en/3.0/security/advisory.html

Source: cve@mitre.org

Vendor Advisory

https://docs.craftercms.org/en/3.0/security/advisory.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.