Lucene search

CVE-2021-29440

🗓️ 13 Apr 2021 20:22:15Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 10 Media mentions👁 135 Views🌐 WEB

Grav file based Web-platform. Twig processing vulnerability allows arbitrary code execution.

AI Insights are available for you today

Leverage the power of AI to quickly understand vulnerabilities, impacts, and exploitability

Reporter	Title	Published	Views	Family All 13
veracode	Remote Code Execution	19 Apr 202109:30	–	veracode
packetstorm	Grav CMS 1.7.10 Server-Side Template Injection	7 Jun 202100:00	–	packetstorm
zdt	Grav CMS 1.7.10 - Server-Side Template Injection (SSTI) (Authenticated) Exploit	7 Jun 202100:00	–	zdt
nvd	CVE-2021-29440	13 Apr 202120:15	–	nvd
github	Grav's Twig processing allowing dangerous PHP functions by default	16 Apr 202119:53	–	github
cvelist	CVE-2021-29440 Twig allowing dangerous PHP functions by default	13 Apr 202119:55	–	cvelist
prion	Design/Logic Flaw	13 Apr 202120:15	–	prion
exploitdb	Grav CMS 1.7.10 - Server-Side Template Injection (SSTI) (Authenticated)	7 Jun 202100:00	–	exploitdb
checkpoint_advisories	Grav CMS Command Injection (CVE-2021-29440)	24 Jun 202100:00	–	checkpoint_advisories
osv	Grav's Twig processing allowing dangerous PHP functions by default	16 Apr 202119:53	–	osv

Nvd

Vulners

Node

getgrav gravRange<1.7.11

[
  {
    "product": "grav",
    "vendor": "getgrav",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.7.11"
      }
    ]
  }
]

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/162987/Grav-CMS-1.7.10-Server-Side-Template-Injection.html
blog	www.blog.sonarsource.com/grav-cms-code-execution-vulnerabilities
packagist	www.packagist.org/packages/getgrav/grav
github	www.github.com/getgrav/grav/security/advisories/GHSA-g8r4-p96j-xfxc

Parameter	Position	Path	Description	CWE
data[header][title]	path	/admin/pages/:add	Endpoint for creating a new page that allows for server-side template injection via the content parameter.	CWE-94
data[content]	path	/admin/pages/:add	Endpoint for creating a new page that allows for server-side template injection via the content parameter.	CWE-94
data[folder]	path	/admin/pages/:add	Endpoint for creating a new page that allows for server-side template injection via the content parameter.	CWE-94
data[name]	path	/admin/pages/:add	Endpoint for creating a new page that allows for server-side template injection via the content parameter.	CWE-94
__unique_form_id__	path	/admin/pages/:add	Endpoint for creating a new page that allows for server-side template injection via the content parameter.	CWE-94
form-nonce	path	/admin/pages/:add	Endpoint for creating a new page that allows for server-side template injection via the content parameter.	CWE-94

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

13 Apr 2021 20:15Current

7.5High risk

Vulners AI Score7.5

CVSS26.5

CVSS37.2 - 8.4

EPSS0.09769

CWE-94