CVE-2021-23263

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/*, /templates/* and some of the files in /.git/* (non-binary).

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-402 CWE-668

Affected software

Vendor	Product	Versions
Crafter Software	Crafter CMS	>= 3.1, < 3.1.15

References

https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2021120106Vendor Advisory
https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2021120106Vendor Advisory

Timeline

Published: Dec 2, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-232649.1Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes.CVE-2021-232654.3A logged-in and authenticated user with a Reviewer Role may lock a content item.CVE-2021-232664.3An anonymous user can craft a URL with text that ends up in the log viewer as is. The text can then include textual messages to mislead the CVE-2021-232678.8Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to exe CVE-2021-232707.5In Gargoyle OS 1.12.0, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and i CVE-2021-232718.0The TIBCO EBX Web Server component of TIBCO Software Inc.'s TIBCO EBX contains a vulnerability that theoretically allows a low privileged at CVE-2021-232725.4The Application Development Clients component of TIBCO Software Inc.'s TIBCO BPM Enterprise and TIBCO BPM Enterprise Distribution for TIBCO CVE-2021-232735.4The Spotfire client component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO CVE-2021-232749.8The Config UI component of TIBCO Software Inc.'s TIBCO API Exchange Gateway and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fab CVE-2021-232757.8The Windows Installation component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R CVE-2021-232768.8Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated SQL injection. A malicious user can send a specially craf CVE-2021-2327710.0Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated eval injection vulnerability. The software does not neu