GHSA-fqff-vcvx-68h3

ghsaUSosv

Grav CMS Cross-Site Request Forgery (CSRF)

view advisory published 2022-05-24Licence: CC-BY-4.0

The Scheduler in Grav CMS through 1.7.0-rc.17 allows an attacker to execute a system command by tricking an admin into visiting a malicious website (CSRF).

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-29553US	high8.8	1.36% (72nd)	—	2021-03-15
The Scheduler in Grav CMS through 1.7.0-rc.17 allows an attacker to execute a system command by tricking an admin into visiting a malicious website (CSRF).

references

External citations — patches, advisories, analysis.

https://blog.bssi.fr/cve-2020-29553-cve-2020-29555-cve-2020-29556-multiple-vulnerabilities-within-cms-gravWEB
https://github.com/getgrav/gravPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2020-29553ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan