CVE-2021-23259

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage. The groovy script does not have security restrictions, which will cause attackers to execute arbitrary commands remotely(RCE).

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-913

Affected software

No affected versions have been published.

Timeline

Published: Dec 2, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-23262.7Vulnerability in the Database Vault component of Oracle Database Server. Supported versions that are affected are 12.2.0.1 and 19c. Easily e CVE-2021-232605.4Authenticated users with Site roles may inject XSS scripts via file names that will execute in the browser for this and other users of the s CVE-2021-232614.9Authenticated administrators may override the system configuration file and cause a denial of service.CVE-2021-232627.2Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE.CVE-2021-232637.5Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/*, /templates/* and some of the files in /CVE-2021-232649.1Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes.CVE-2021-232654.3A logged-in and authenticated user with a Reviewer Role may lock a content item.CVE-2021-232664.3An anonymous user can craft a URL with text that ends up in the log viewer as is. The text can then include textual messages to mislead the CVE-2021-232678.8Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to exe CVE-2021-232707.5In Gargoyle OS 1.12.0, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and i CVE-2021-232718.0The TIBCO EBX Web Server component of TIBCO Software Inc.'s TIBCO EBX contains a vulnerability that theoretically allows a low privileged at CVE-2021-232725.4The Application Development Clients component of TIBCO Software Inc.'s TIBCO BPM Enterprise and TIBCO BPM Enterprise Distribution for TIBCO