CVE-2024-28116

Published: Mar 21, 2024

Modified: Aug 2, 2024

PUBLISHED

CVSS v3.1

8.8

HIGH

Description

Grav is an open-source, flat-file content management system. Grav CMS prior to version 1.7.45 is vulnerable to a Server-Side Template Injection (SSTI), which allows any authenticated user (editor permissions are sufficient) to execute arbitrary code on the remote server bypassing the existing security sandbox. Version 1.7.45 contains a patch for this issue.

Vendor	Product	Versions
getgrav	grav	affected `< 1.7.45`

Weaknesses (CWE)

CWE-94

CWE-1336

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

References

https://github.com/getgrav/grav/security/advisories/GHSA-c9gp-64c4-2rrh

x_refsource_CONFIRM

https://github.com/getgrav/grav/commit/4149c81339274130742831422de2685f298f3a6e

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2024-28116

Description

Affected Products

Weaknesses (CWE)

CVSS v3.1 Details

References