CSRF Vulnerability in Grav CMS Affects Versions Up to 1.7.0-rc.17
CVE-2020-29553

8.8HIGH

Key Information:

Vendor

Getgrav

Status
Grav Cms
Vendor
CVE Published:
15 March 2021

What is CVE-2020-29553?

A vulnerability in the Scheduler component of Grav CMS versions up to 1.7.0-rc.17 allows attackers to exploit Cross-Site Request Forgery (CSRF) by deceiving an administrator into visiting a crafted malicious link. This could lead to the unauthorized execution of system commands on the server, compromising the integrity and security of the application.

References

https://blog.bssi.fr/cve-2020-29553-cve-2020-29555-cve-20...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.