CVE-2021-23258
Spring SPEL Expression Language Injection
- State
- Published
- Severity
- 4.2 Medium
- Published
- Dec 2, 2021
- Updated
- Sep 16, 2024
- Reserved
- Jan 8, 2021
Description
Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SPEL Expression does not have security restrictions, which will cause attackers to execute arbitrary commands remotely (RCE).
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.2 Medium | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H | crafter |
Weaknesses
- CWE-913 Improper Control of Dynamically-Managed Code Resources
Affected Products
| Product | Versions |
|---|---|
Crafter CMSCrafter Software |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.