CVE-2023-26020 MEDIUM

CVE-2023-26020: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Crafter Studio

Vendor Craftercms
Product CrafterCMS
Weakness CWE-89 · SQLi
Published February 17, 2023
Last update March 12, 2025
View on NVD All CVEs

CVSS base score

5.7/10
Attack vector Network
Attack complexity High
Privileges required High
User interaction Required
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:H

What the vulnerability does

01Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crafter Studio on Linux, MacOS, Windows, x86, ARM, 64 bit allows SQL Injection.This issue affects CrafterCMS v4.0 from 4.0.0 through 4.0.1, and v3.1 from 3.1.0 through 3.1.26.

Key dates

02Disclosure timeline

February 17, 2023 CVE published
March 12, 2025 Record updated