CVE-2017-15685: XML Injection in Crafter CMS Crafter Studio 3.0.1
Summary
CVE-2017-15685: XML Injection in Crafter CMS Crafter Studio 3.0.1. Affects org.craftercms:crafter-studio versions < 3.0.2. Fixed in 3.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Crafter CMS Crafter Studio 3.0.1 is a Maven package that provides a content management system for creating and managing websites. It allows users to create sites using XML files. However, this version is vulnerable to XML External Entity (XXE) injection. An attacker can exploit this vulnerability by creating a site with specially crafted XML, which can lead to the retrieval of operating system files.
Vulnerability Detail
The vulnerability in Crafter CMS Crafter Studio 3.0.1 arises from the lack of proper input validation and handling of XML files. By injecting malicious XML entities, an attacker can trigger the parsing of external entities, leading to the disclosure of sensitive information or remote code execution. This can have severe consequences, including unauthorized access to system files and potential compromise of the entire system.
How To Fix
Latest published version: 4.3.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.0.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to a patched version of the Crafter CMS Crafter Studio package.
Conclusion
The XML Injection vulnerability in Crafter CMS Crafter Studio 3.0.1 can lead to the retrieval of operating system files by an unauthenticated attacker. To mitigate this vulnerability, it is crucial to upgrade to version 3.0.2 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.craftercms:crafter-studio →
FAQ
The vulnerability allows an attacker to retrieve operating system files, potentially leading to unauthorized access and compromise of the system.
No, an unauthenticated attacker can exploit this vulnerability.
No, only version 3.0.1 is affected. Upgrading to version 3.0.2 or later will fix the vulnerability.
Yes, this vulnerability can be exploited remotely.
There is no known public exploit for this vulnerability at the moment.
Related vulnerabilities
Recent vulnerabilities recorded for org.craftercms:crafter-studio.
