Cross site scripting in Crafter CMS

MEDIUM 6.1CVE-2017-15682 · GHSA-38rq-rh9w-cmw6 · Published 27/11/2020 · updated 09/07/2026

In short

CVE-2017-15682 is a MEDIUM (CVSS 6.1) vulnerability affecting org.craftercms:crafter-core, crafter cms (craftercms).
Chance of exploitation in the next 30 days (EPSS): 0.75%, higher than 55.0% of all vulnerabilities.
Fix: update to 3.0.1 or later.

Package	Affected versions	Patched versions
org.craftercms:crafter-core Maven	`≥ 3.0.0, < 3.0.1`	`3.0.1`
crafter cms craftercms	`≥ 3.0.0, < 3.0.1`	`3.0.1`

Description

In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to inject malicious JavaScript code resulting in a stored/blind XSS in the admin panel.

NVD description

In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to inject malicious JavaScript code resulting in a stored/blind XSS in the admin panel.

References

nvd.nist.gov/vuln/detail/CVE-2017-15682 · ADVISORY
docs.craftercms.org/en/3.0/security/advisory.html · WEB

More vulnerabilities in org.craftercms:crafter-core

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free