VulnerabilityModified

CVE-2021-23258

Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans.

HIGH 7.2EPSS 0.70%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.70%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SPEL Expression does not have security restrictions, which will cause attackers to execute arbitrary commands remotely (RCE).

CVSS 3.1: 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.70% probability · 51th percentile
CISA KEV: Not listed
Weakness: CWE-913
Affected: craftercms/crafter cms
Source: security@craftersoftware.com

References

https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2021120101Vendor Advisory
https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2021120101Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.