GHSA-977g-93f5-rqjx

ghsaUSosv

Grav CMS Cross-site scripting (XSS) vulnerability

view advisory published 2022-05-14Licence: CC-BY-4.0

Cross-site scripting (XSS) vulnerability in `system/src/Grav/Common/Twig/Twig.php` in Grav CMS before 1.3.0 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to admin/tools.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2018-5233US	medium6.1	3.65% (90th)	—	2018-03-19
Cross-site scripting (XSS) vulnerability in system/src/Grav/Common/Twig/Twig.php in Grav CMS before 1.3.0 allows remote attackers to inject arbitrary web script or HTML via the PAT…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2018/03/15/1WEB
https://github.com/getgrav/gravPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2018-5233ADVISORY
https://sysdream.com/news/lab/2018-03-15-cve-2018-5233-grav-cms-admin-plugin-reflected-cross-site-scripting-xss-vulnerabilityWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan