DOMSanitizer (aka dom-sanitizer) before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular expressions.
Max CVSS
6.1
EPSS Score
0.05%
Published
2023-11-22
Updated
2023-11-28
Grav is a file-based Web-platform built in PHP. Grav is subject to a server side template injection (SSTI) vulnerability. The fix for another SSTI vulnerability using `|map`, `|filter` and `|reduce` twigs implemented in the commit `71bbed1` introduces bypass of the denylist due to incorrect return value from `isDangerousFunction()`, which allows to execute the payload prepending double backslash (`\\`). The `isDangerousFunction()` check in version 1.7.42 and onwards retuns `false` value instead of `true` when the `\` symbol is found in the `$name`. This vulnerability can be exploited if the attacker has access to: 1. an Administrator account, or 2. a non-administrator, user account that has Admin panel access and Create/Update page permissions. A fix for this vulnerability has been introduced in commit `b4c6210` and is included in release version `1.7.42.2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Max CVSS
8.8
EPSS Score
0.06%
Published
2023-07-18
Updated
2023-07-28
Grav is a flat-file content management system. In versions 1.7.42 and prior, the "/forgot_password" page has a self-reflected cross-site scripting vulnerability that can be exploited by injecting a script into the "email" parameter of the request. While this vulnerability can potentially allow an attacker to execute arbitrary code on the user's browser, the impact is limited as it requires user interaction to trigger the vulnerability. As of time of publication, a patch is not available. Server-side validation should be implemented to prevent this vulnerability.
Max CVSS
6.1
EPSS Score
0.05%
Published
2023-06-14
Updated
2023-06-22
Grav is a flat-file content management system. Prior to version 1.7.42, the patch for CVE-2022-2073, a server-side template injection vulnerability in Grav leveraging the default `filter()` function, did not block other built-in functions exposed by Twig's Core Extension that could be used to invoke arbitrary unsafe functions, thereby allowing for remote code execution. A patch in version 1.74.2 overrides the built-in Twig `map()` and `reduce()` filter functions in `system/src/Grav/Common/Twig/Extension/GravExtension.php` to validate the argument passed to the filter in `$arrow`.
Max CVSS
8.8
EPSS Score
0.28%
Published
2023-06-14
Updated
2023-06-22
Grav is a file-based Web platform. Prior to version 1.7.42, the denylist introduced in commit 9d6a2d to prevent dangerous functions from being executed via injection of malicious templates was insufficient and could be easily subverted in multiple ways -- (1) using unsafe functions that are not banned, (2) using capitalised callable names, and (3) using fully-qualified names for referencing callables. Consequently, a low privileged attacker with login access to Grav Admin panel and page creation/update permissions is able to inject malicious templates to obtain remote code execution. A patch in version 1.7.42 improves the denylist.
Max CVSS
8.8
EPSS Score
0.54%
Published
2023-06-14
Updated
2023-06-23
Grav is a file-based Web platform. Prior to version 1.7.42, there is a logic flaw in the `GravExtension.filterFilter()` function whereby validation against a denylist of unsafe functions is only performed when the argument passed to filter is a string. However, passing an array as a callable argument allows the validation check to be skipped. Consequently, a low privileged attacker with login access to Grav Admin panel and page creation/update permissions is able to inject malicious templates to obtain remote code execution. The vulnerability can be found in the `GravExtension.filterFilter()` function declared in `/system/src/Grav/Common/Twig/Extension/GravExtension.php`. Version 1.7.42 contains a patch for this issue. End users should also ensure that `twig.undefined_functions` and `twig.undefined_filters` properties in `/path/to/webroot/system/config/system.yaml` configuration file are set to `false` to disallow Twig from treating undefined filters/functions as PHP functions and executing them.
Max CVSS
8.8
EPSS Score
0.20%
Published
2023-06-14
Updated
2023-06-23
Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection. Remote code execution is possible by embedding malicious PHP code on the administrator screen by a user with page editing privileges. Version 1.7.42 contains a fix for this issue.
Max CVSS
9.9
EPSS Score
0.14%
Published
2023-06-14
Updated
2023-06-22
A cross-site scripting (XSS) vulnerability in Grav versions 1.7.44 and before, allows remote authenticated attackers to execute arbitrary web scripts or HTML via the onmouseover attribute of an ISINDEX element.
Max CVSS
5.4
EPSS Score
0.05%
Published
2024-02-09
Updated
2024-02-15
Code Injection in GitHub repository getgrav/grav prior to 1.7.34.
Max CVSS
9.1
EPSS Score
0.10%
Published
2022-06-29
Updated
2022-07-08
stored xss in GitHub repository getgrav/grav prior to 1.7.33.
Max CVSS
8.2
EPSS Score
0.05%
Published
2022-04-26
Updated
2022-05-05
Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31.
Max CVSS
7.1
EPSS Score
0.05%
Published
2022-03-15
Updated
2022-03-22
Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31.
Max CVSS
4.6
EPSS Score
0.05%
Published
2022-02-28
Updated
2022-03-10
Cross-site Scripting (XSS) - Stored in Packagist getgrav/grav prior to 1.7.28.
Max CVSS
5.7
EPSS Score
0.05%
Published
2022-01-25
Updated
2022-01-28
Grav is a file based Web-platform. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance. The issue was addressed in version 1.7.11.
Max CVSS
8.4
EPSS Score
2.73%
Published
2021-04-13
Updated
2022-11-09
The Grav admin plugin prior to version 1.10.11 does not correctly verify caller's privileges. As a consequence, users with the permission `admin.login` can install third-party plugins and their dependencies. By installing the right plugin, an attacker can obtain an arbitrary code execution primitive and elevate their privileges on the instance. The vulnerability has been addressed in version 1.10.11. As a mitigation blocking access to the `/admin` path from untrusted sources will reduce the probability of exploitation.
Max CVSS
7.2
EPSS Score
0.12%
Published
2021-04-13
Updated
2023-11-06

CVE-2021-21425

Public exploit
Grav Admin Plugin is an HTML user interface that provides a way to configure Grav and create and modify pages. In versions 1.10.7 and earlier, an unauthenticated user can execute some methods of administrator controller without needing any credentials. Particular method execution will result in arbitrary YAML file creation or content change of existing YAML files on the system. Successfully exploitation of that vulnerability results in configuration changes, such as general site information change, custom scheduler job definition, etc. Due to the nature of the vulnerability, an adversary can change some part of the webpage, or hijack an administrator account, or execute operating system command under the context of the web-server user. This vulnerability is fixed in version 1.10.8. Blocking access to the `/admin` path from untrusted sources can be applied as a workaround.
Max CVSS
9.8
EPSS Score
71.50%
Published
2021-04-07
Updated
2022-10-24
grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Max CVSS
8.8
EPSS Score
0.13%
Published
2021-11-05
Updated
2021-11-09
grav-plugin-admin is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Max CVSS
5.4
EPSS Score
0.05%
Published
2021-11-19
Updated
2021-11-23
grav is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Max CVSS
6.3
EPSS Score
0.05%
Published
2021-10-27
Updated
2021-10-29
grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking
Max CVSS
6.3
EPSS Score
0.07%
Published
2021-09-27
Updated
2021-09-30
grav-plugin-admin is vulnerable to Improper Restriction of Rendered UI Layers or Frames
Max CVSS
5.8
EPSS Score
0.05%
Published
2021-09-27
Updated
2021-09-30
The Backup functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to read arbitrary local files on the underlying server by exploiting a path-traversal technique. (This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection.)
Max CVSS
5.5
EPSS Score
0.06%
Published
2021-03-15
Updated
2021-03-25
The BackupDelete functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to delete arbitrary files on the underlying server by exploiting a path-traversal technique. (This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection.)
Max CVSS
8.1
EPSS Score
0.08%
Published
2021-03-15
Updated
2021-03-25
The Scheduler in Grav CMS through 1.7.0-rc.17 allows an attacker to execute a system command by tricking an admin into visiting a malicious website (CSRF).
Max CVSS
8.8
EPSS Score
0.11%
Published
2021-03-15
Updated
2021-03-18
Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x.
Max CVSS
6.1
EPSS Score
0.45%
Published
2020-04-04
Updated
2021-05-17
27 vulnerabilities found
1 2
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!