{"id":"CVE-2021-23264","aliases":["GHSA-2wr2-8qjq-gh55"],"url":"https://o3.security/vulnerability/CVE-2021-23264","summary":"Exposure of Resource to Wrong Sphere in org.craftercms:crafter-search","details":"Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes.","published":"2021-12-02T16:15:07.787Z","modified":"2026-08-27T08:14:38.200640Z","cvss":{"score":9.1,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},"epss":{"score":0.0114,"percentile":0.63689,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.craftercms:crafter-search","fixedVersion":"3.1.15"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2021120107"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-27T08:14:38.200640Z"}}