Grav CMS Cross-Site Request Forgery (CSRF)

2022-05-2417:44:32

Google

osv.dev

8.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.2%

JSON

The Scheduler in Grav CMS through 1.7.0-rc.17 allows an attacker to execute a system command by tricking an admin into visiting a malicious website (CSRF).

CPENameOperatorVersion
getgrav/graveq0.9.36
getgrav/graveq1.3.0-rc.3
getgrav/graveq0.9.22
getgrav/graveq1.5.1
getgrav/graveq0.9.1
getgrav/graveq1.7.0-rc.12
getgrav/graveq1.7.0-rc.2
getgrav/graveq1.4.2
getgrav/graveq1.6.0-beta.3
getgrav/graveq1.6.3

Name	Operator	Version
getgrav/grav	eq	0.9.36
getgrav/grav	eq	1.3.0-rc.3
getgrav/grav	eq	0.9.22
getgrav/grav	eq	1.5.1
getgrav/grav	eq	0.9.1
getgrav/grav	eq	1.7.0-rc.12
getgrav/grav	eq	1.7.0-rc.2
getgrav/grav	eq	1.4.2
getgrav/grav	eq	1.6.0-beta.3
getgrav/grav	eq	1.6.3