CVE-2021-23264
Transmission of Private Resources into a New Sphere ('Resource Leak') and Exposure of Resource to Wrong Sphere in Crafter Search
Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Transmission of Private Resources into a New Sphere ('Resource Leak') and Exposure of Resource to Wrong Sphere in Crafter Search
Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes.
- Record
CVE-2021-23264- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-402, CWE-668
- Updated
- 2026-11-02
EUVDEUVD-2021-2427
Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes.
- Record
EUVD-2021-2427- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2wr2-8qjq-gh55
Exposure of Resource to Wrong Sphere in org.craftercms:crafter-search
Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes.
- Record
GHSA-2wr2-8qjq-gh55- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-402, CWE-668
- Updated
- 2026-11-02
NVD
Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes.
- Record
CVE-2021-23264- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:P/A:N - Weakness
- CWE-402, CWE-668
- Updated
- 2026-11-02
OSV
Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes.
- Record
CVE-2021-23264- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-2wr2-8qjq-gh55
Exposure of Resource to Wrong Sphere in org.craftercms:crafter-search
Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes.
- Record
GHSA-2wr2-8qjq-gh55- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-402, CWE-668
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.craftercms:crafter-searchMaven |
3.1.0 up to 3.1.15 | 3.1.15 |
org.craftercms:crafter-searchMaven |
3.1.0 up to 3.1.15, plus listed versions 3.1.13.1.103.1.10E3.1.113.1.11E Show 20 moreShow less3.1.123.1.12E3.1.133.1.13E3.1.143.1.14E3.1.23.1.33.1.43.1.4E3.1.53.1.5E3.1.63.1.6E3.1.73.1.7E3.1.83.1.8E3.1.93.1.9E |
3.1.15 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-23264 is a high vulnerability (CVSS 8.1) in Crafter Software Cms, published December 2, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.18%, the 67th percentile. Fixed in org.craftercms:crafter-search 3.1.15.