Cross-Site Scripting Vulnerability in Grav CMS by GetGrav
CVE-2018-5233

6.1MEDIUM

Key Information:

Vendor

Getgrav

Status
Grav Cms
Vendor
CVE Published:
19 March 2018

What is CVE-2018-5233?

An XSS vulnerability exists in Grav CMS prior to version 1.3.0, affecting the admin tools component. This flaw allows remote attackers to inject arbitrary web scripts or HTML into web pages via manipulation of the PATH_INFO parameter. Successful exploitation can lead to unauthorized access or data compromise, making it crucial for users to update to the latest version to safeguard their systems.

References

https://sysdream.com/news/lab/2018-03-15-cve-2018-5233-gr...
x_refsource_MISC
http://www.openwall.com/lists/oss-security/2018/03/15/1
mailing-listx_refsource_MLIST

EPSS Score

18% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.