PT-2021-21988 · Grav · Grav

Published 2021-09-27 · Updated 2021-10-01 · CVE-2021-3818

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: grav (affected versions not specified)

Description: The issue concerns a reliance on cookies without proper validation and integrity checking. This can lead to a situation where a cookie with an overly broad path can be accessed through other applications on the same domain. As cookies often carry sensitive information, such as session identifiers, sharing them across applications can cause a vulnerability in one application to compromise another.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-565

Related Identifiers

CVE-2021-3818

GHSA-CG3Q-59W7-RVC2

Affected Products

Grav

References · 8

• 🔥 https://huntr.dev/bounties/c2bc65af-7b93-4020-886e-8cdaeb0a58ea · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-3818 · Security Note
• https://osv.dev/vulnerability/CVE-2021-3818 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cg3q-59w7-rvc2 · Vendor Advisory
• https://github.com/getgrav/grav · Note
• https://github.com/getgrav/grav/commit/c51fb1779b83f620c0b6f3548d4a96322b55df07 · Note
• https://t.me/cvenotify/21710 · Telegram Post
• https://t.me/cibsecurity/29463 · Telegram Post