What is GHSA-fqff-vcvx-68h3?

GHSA-fqff-vcvx-68h3 is a security advisory published by GitHub Security Advisories with High severity. Grav CMS Cross-Site Request Forgery (CSRF)

Which CVE IDs does GHSA-fqff-vcvx-68h3 cover?

GHSA-fqff-vcvx-68h3 covers the following CVE IDs: CVE-2020-29553. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fqff-vcvx-68h3?

GHSA-fqff-vcvx-68h3 has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-fqff-vcvx-68h3?

GHSA-fqff-vcvx-68h3 affects 2 products, including: composer/getgrav/grav:\u003e= 1.7.0-beta.1, \u003c= 1.7.0-rc.17; composer/getgrav/grav:\u003c 1.6.30.

GHSA-fqff-vcvx-68h3HighCVSS 8.8

Grav CMS Cross-Site Request Forgery (CSRF)

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

April 24, 2024

🔗 CVE IDs covered (1)

CVE-2020-29553 →

📋 Description

The Scheduler in Grav CMS through 1.7.0-rc.17 allows an attacker to execute a system command by tricking an admin into visiting a malicious website (CSRF).

🎯 Affected products2

composer/getgrav/grav:>= 1.7.0-beta.1, <= 1.7.0-rc.17
composer/getgrav/grav:< 1.6.30

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2020-29553
https://blog.bssi.fr/cve-2020-29553-cve-2020-29555-cve-2020-29556-multiple-vulnerabilities-within-cms-grav
https://github.com/advisories/GHSA-fqff-vcvx-68h3