-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.craftercms:crafter-studio | maven | >= 3.1.0, < 3.1.23 | 3.1.23 |
Miggo AIRoot Cause AnalysisThe vulnerability explicitly involves FreeMarker SSTI to execute OS commands. FreeMarker's default configurations are unsafe when combined with untrusted templates, as they allow instantiation of arbitrary classes. CrafterCMS's advisory history (e.g., CVE-2020-25803) shows recurring issues with FreeMarker's ObjectWrapper allowing static method access. The FreeMarkerScriptProcessor class is a logical component responsible for template processing, and improper configuration here would directly enable the described attack vector. The lack of patch details is mitigated by historical patterns in CrafterCMS vulnerabilities and FreeMarker's known security requirements.