medium4.2
CVE-2021-23259
Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage.
Impact
Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage. The groovy script does not have security restrictions, which will cause attackers to execute arbitrary commands remotely(RCE).
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Craftercms | Crafter Cms | from 3.1.0 before 3.1.12 |