Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass sandbox restrictions and obtain RCE (Remote Code Execution).
Recommended action: Upgrade to 4.5.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass.
Recommended action: Upgrade to 3.1.23 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A logged-in and authenticated user with a Reviewer Role may lock a content item.
Recommended action: Upgrade to 3.1.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An anonymous user can craft a URL with text that ends up in the log viewer as is. The text can then include textual messages to mislead the administrator.
Recommended action: Upgrade to 3.1.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.