GHSA-cg3q-59w7-rvc2

ghsaUSosv

Reliance on Cookies without Validation and Integrity Checking in getgrav/grav

view advisory published 2021-09-29Licence: CC-BY-4.0

grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking. A cookie with an overly broad path can be accessed through other applications on the same domain. Since cookies often carry sensitive information such as session identifiers, sharing cookies across applications can lead a vulnerability in one application to cause a compromise in another.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-3818US	medium5.3	2.45% (84th)	—	2021-09-27
grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking

references

External citations — patches, advisories, analysis.

https://github.com/getgrav/gravPACKAGE
https://github.com/getgrav/grav/commit/c51fb1779b83f620c0b6f3548d4a96322b55df07WEB
https://huntr.dev/bounties/c2bc65af-7b93-4020-886e-8cdaeb0a58eaWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan