Exposure of Resource to Wrong Sphere in org.craftercms:crafter-search

CRÍTICO 9.1CVE-2021-23264 · GHSA-2wr2-8qjq-gh55 · Published 02/12/2021 · updated 17/06/2026

En resumen

CVE-2021-23264 es una vulnerabilidad CRÍTICO (CVSS 9.1) que afecta a org.craftercms:crafter-search, crafter cms (craftercms).
Probabilidad de explotación en los próximos 30 días (EPSS): 1.2%, mayor que el 67.6% de las vulnerabilidades.
Solución: actualizar a 3.1.15 o posterior.

Package	Affected versions	Patched versions
org.craftercms:crafter-search Maven	`≥ 3.1.0, < 3.1.15`	`3.1.15`
crafter cms craftercms	`≥ 3.1.0, < 3.1.15`	`3.1.15`

Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes.

NVD description

Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.