high8.8
CVE-2020-29553
Grav CMS Cross-Site Request Forgery (CSRF)
Impact
The Scheduler in Grav CMS through 1.7.0-rc.17 allows an attacker to execute a system command by tricking an admin into visiting a malicious website (CSRF).
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | getgrav/grav | >= 1.7.0-beta.1, <= 1.7.0-rc.17 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Getgrav | Grav Cms | through 1.6.31 Version 1.7.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://blog.bssi.fr/cve-2020-29553-cve-2020-29555-cve-2020-29556-multiple-vulnerabilities-within-cms-grav/
- https://github.com/advisories/GHSA-fqff-vcvx-68h3
- https://nvd.nist.gov/vuln/detail/CVE-2020-29553
- https://blog.bssi.fr/cve-2020-29553-cve-2020-29555-cve-2020-29556-multiple-vulnerabilities-within-cms-grav