~ / search / GHSA-545f-pgp7-fwjf

GHSA-545f-pgp7-fwjf

Log value insertion in craftercms

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-23266

Packages

EcosystemPackageAffectedFixed in
Maven org.craftercms:craftercms >= 3.1.0, < 3.1.18 3.1.18

Details

As written in the advisory (Markdown source, shown as plain text).

An anonymous user can craft a URL with text that ends up in the log viewer as is. The text can then include textual messages to mislead the administrator.

References

External links from the advisory. They lead to third-party sites.