Description
In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band.
Remediation
References
http://crafter.com
https://docs.craftercms.org/en/3.0/security/advisory.html
Related Vulnerabilities
CVE-2018-14042 Vulnerability in maven package org.webjars:bootstrap-sass
CVE-2022-28220 Vulnerability in maven package org.apache.james.protocols:protocols-netty
CVE-2022-36663 Vulnerability in maven package org.gluu:oxauth-common
CVE-2021-26543 Vulnerability in npm package git-parse
CVE-2019-10361 Vulnerability in maven package org.jenkins-ci.plugins.m2release:m2release