PT-2021-11692 · Grav Cms · Grav Cms

Published 2021-03-15 · Updated 2022-05-24 · CVE-2020-29555

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Grav CMS versions 1.7.0-rc.17 and earlier

Description: The issue allows an authenticated attacker to delete arbitrary files on the server using a path-traversal technique. Additionally, an unauthenticated attacker can exploit this due to a lack of CSRF protection. The Scheduler component can also be exploited by tricking an admin into visiting a malicious website, allowing an attacker to execute system commands.

Recommendations: For Grav CMS versions 1.7.0-rc.17 and earlier, consider disabling the BackupDelete functionality and restrict access to the Scheduler component until a patch is available. As a temporary workaround, implement CSRF protection to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-29555

GHSA-GPMF-Q5JH-HJX4

Affected Products

Grav Cms

References · 8

• 🔥 https://blog.bssi.fr/cve-2020-29553-cve-2020-29555-cve-2020-29556-multiple-vulnerabilities-within-cms-grav · Exploit
• https://osv.dev/vulnerability/GHSA-gpmf-q5jh-hjx4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-29555 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-29555 · Security Note
• https://github.com/getgrav/grav · Note
• https://t.me/cvenotify/11917 · Telegram Post
• https://t.me/cvenotify/11919 · Telegram Post
• https://t.me/cvenotify/11366 · Telegram Post