Search/CVE-2021-23258
● CVE — Medium

CVE-2021-23258

VendorcraftercmsProductcrafter cmsDiscoveredDec 2, 2021UpdatedNov 21, 2024

Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SPEL Expression does not have security restrictions, which will cause attackers to execute arbitrary commands remotely (RCE).

View graph Watch Export
CVSS v3.1
4.2 MEDIUM
EPSS
0.73%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Aug 16, 2026 → Sep 26, 2026
▲ 0.02pp
0.70% → 0.73% over 2 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityHIGH
Privileges RequiredHIGH
User InteractionREQUIRED
ScopeUNCHANGED
ConfidentialityNONE
IntegrityNONE
AvailabilityHIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H
Connections
2 relationships
Timeline
disclosure → media coverage
Dec 2, 2021
Disclosure — published as a CVE record. · last revised by NVD Nov 21, 2024