PT-2022-14839 · Unknown · Getgrav/Grav

Mahagr · Published 2022-06-29 · Updated 2023-06-15 · CVE-2022-2073

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions getgrav/grav versions prior to 1.7.34

Description The issue concerns Server Side Template Injection via Twig, where Twig should not render dangerous functions by default, such as system. This is related to Code Injection in the GitHub repository getgrav/grav.

Recommendations For versions prior to 1.7.34, update to version 1.7.34 or later to resolve the issue. As a temporary workaround, consider restricting the use of Twig to minimize the risk of exploitation. Avoid using dangerous functions, such as system, in Twig templates until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2022-2073

GHSA-CXGW-R5JG-7XWQ

Affected Products

Getgrav/Grav

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2073.json · Exploit
• 🔥 https://huntr.dev/bounties/3ef640e6-9e25-4ecb-8ec1-64311d63fe66 · Exploit
• https://github.com/getgrav/grav/commit/9d6a2dba09fd4e56f5cdfb9a399caea355bfeb83 · Patch
• https://osv.dev/vulnerability/CVE-2022-2073 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2073 · Security Note
• https://osv.dev/vulnerability/GHSA-cxgw-r5jg-7xwq · Vendor Advisory
• https://github.com/getgrav/grav · Note
• https://t.me/cvenotify/52365 · Telegram Post