Exposure of Resource to Wrong Sphere in org.craftercms:crafter-search

CRITIQUE 9.1CVE-2021-23264 · GHSA-2wr2-8qjq-gh55 · Published 02/12/2021 · updated 17/06/2026

En bref

CVE-2021-23264 est une vulnérabilité CRITIQUE (CVSS 9.1) touchant org.craftercms:crafter-search, crafter cms (craftercms).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.2%, plus élevée que 67.6% des vulnérabilités.
Correctif : mettre à jour vers 3.1.15 ou plus récent.

Package	Affected versions	Patched versions
org.craftercms:crafter-search Maven	`≥ 3.1.0, < 3.1.15`	`3.1.15`
crafter cms craftercms	`≥ 3.1.0, < 3.1.15`	`3.1.15`

Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes.

NVD description

Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.