Resource Leak Vulnerability in CrafterCMS Engine on Multiple Platforms
CVE-2025-0502

6.9MEDIUM

Key Information:

Vendor
Craftercms
Status
Craftercms
Vendor
CVE Published:
15 January 2025

Summary

A vulnerability exists in the CrafterCMS Engine that allows for a resource leak, enabling directory indexing and potential exposure of private resources. This issue affects versions of CrafterCMS from 4.0.0 before 4.0.8 and from 4.1.0 before 4.1.6, across multiple operating systems including Linux, MacOS, Windows, and ARM. Administrators should ensure they are running updated versions to mitigate the risk associated with this vulnerability.

Affected Version(s)

CrafterCMS Linux 4.0.0 < 4.0.8

CrafterCMS Linux 4.1.0 < 4.1.6

References

https://craftercms.com/docs/current/security/advisory.htm...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Carlos Ortiz, https://github.com/cortiz
.