CVE-2021-23262 MEDIUM

CVE-2021-23262: Snakeyaml deserialization vulnerability bypass

Vendor Crafter Software

Product Crafter CMS

Weakness CWE-913

Published December 2, 2021

Last update September 16, 2024

CVSS base score

4.2/10

Attack vector Network

Attack complexity High

Privileges required High

User interaction Required

Confidentiality None

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE.

Key dates

December 2, 2021 CVE published

September 16, 2024 Record updated

External resources

Related vulnerabilities