CVE-2017-15685

{"id": "CVE-2017-15685", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.9}]}, "published": "2020-11-27T18:15:11.267", "references": [{"url": "http://crafter.com", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://docs.craftercms.org/en/3.0/security/advisory.html", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://crafter.com", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://docs.craftercms.org/en/3.0/security/advisory.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-91"}]}], "descriptions": [{"lang": "en", "value": "Crafter CMS Crafter Studio 3.0.1 is affected by: XML External Entity (XXE). An unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band."}, {"lang": "es", "value": "Crafter CMS Crafter Studio versi\u00f3n 3.0.1, est\u00e1 afectado por: un ataque de tipo XML External Entity (XXE). Un atacante no autenticado es capaz de crear un sitio con XML especialmente dise\u00f1ado que permite la recuperaci\u00f3n de archivos del Sistema Operativo fuera de banda"}], "lastModified": "2024-11-21T03:15:00.350", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:craftercms:crafter_cms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0003F68D-860C-456F-950F-FECE6D9BC0EE", "versionEndExcluding": "3.0.1", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}