GitHub Advisoryadvisory · Maven

GHSA-5644-3vgq-2ph5 Crafter Studio Groovy Sandbox Bypass

HIGH Published 2025-06-19 Modified 2025-06-20 Official page ↗
Aliases
CVE-2025-6384
Ecosystem
Maven
Packages
org.craftercms:crafter-studio
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H
Weaknesses
CWE-913
Reviewed
2025-06-20

Affected packages

• Maven org.craftercms:crafter-studio: >= 4.0.0, < 4.3.0 → fixed in 4.3.0

Description

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass Sandbox restrictions and obtain RCE (Remote Code Execution). This issue affects CrafterCMS: from 4.0.0 through 4.2.2.

Related

Alias · CVE (1)

  • CVE-2025-6384 Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to… vulnerability

Weakness · CWE (1)

  • CWE-913 Improper Control of Dynamically-Managed Code Resources weakness

References