CVE-2021-23264CWE-402CWE-668

Transmission of Private Resources into a New Sphere ('Resource Leak') and Exposure of Resource to Wrong Sphere in Crafter Search

High · published December 2, 2021

CVSS v3.1
8.1
EPSS
1%
Percentile
67.4
In the wild
Unconfirmed
What it is

Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01177 · 67.4th percentile
Weaknesses
CWE-402 · Transmission of Private Resources into a New Sphere ('Resource Leak'); CWE-668 · Exposure of Resource to Wrong Sphere
Published
2021-12-02T15:40Z
EPSS history
Timeline
  • 02 DEC 15:40Z
    Transmission of Private Resources into a New Sphere ('Resource Leak') and Exposure of Resource to Wrong Sphere in Crafter Search
    cvelistv5