PT-2021-14497 · Grav · Grav Admin Plugin

🗓️ 07 Apr 2021 00:00:00Reported by Positive TechnologiesType

Unauthenticated access in Grav Admin Plugin allows arbitrary YAML changes via admin controller, risking site hijack.

Reporter	Title	Published	Views	Family All 17
0day.today	GravCMS 1.10.7 - Unauthenticated Arbitrary YAML Write/Update Exploit	21 Apr 202100:00	–	zdt
0day.today	GravCMS 1.10.7 Remote Command Execution Exploit	4 May 202100:00	–	zdt
GithubExploit	Exploit for Improper Access Control in Getgrav Grav-Plugin-Admin	15 May 202617:42	–	githubexploit
GithubExploit	Exploit for Improper Access Control in Getgrav Grav-Plugin-Admin	13 Nov 202400:30	–	githubexploit
GithubExploit	Exploit for Improper Access Control in Getgrav Grav-Plugin-Admin	21 Jan 202604:45	–	githubexploit
Circl	CVE-2021-21425	21 Apr 202100:00	–	circl
CNNVD	Grav 安全漏洞	7 Apr 202100:00	–	cnnvd
CVE	CVE-2021-21425	7 Apr 202118:20	–	cve
Cvelist	CVE-2021-21425 Unauthenticated Arbitrary YAML Write/Update leads to Code Execution	7 Apr 202118:20	–	cvelist
Exploit DB	GravCMS 1.10.7 - Unauthenticated Arbitrary File Write (Metasploit)	21 Apr 202100:00	–	exploitdb

Source	Link
github	www.github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/gravcms_exec.rb
github	www.github.com/CsEnox/CVE-2021-21425
pentest	www.pentest.blog/unexpected-journey-7-gravcms-unauthenticated-arbitrary-yaml-write-update-leads-to-code-execution
exploit-db	www.exploit-db.com/exploits/49788
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-21425
osv	www.osv.dev/vulnerability/CVE-2021-21425
github	www.github.com/getgrav/grav-plugin-admin/security/advisories/GHSA-6f53-6qgv-39pj
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
packetstormsecurity	www.packetstormsecurity.com/files/162283/GravCMS-1.10.7-Remote-Command-Execution.html
packetstormsecurity	www.packetstormsecurity.com/files/162457/GravCMS-1.10.7-Remote-Command-Execution.html

24 Oct 2022 00:00Current

9.5High risk

Vulners AI Score9.5

CVSS 3.19.3 - 9.8

CVSS 27.5

EPSS0.91021