CVE-2021-29440

Grav is a file based Web-platform. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance. The issue was addressed in version 1.7.11.
Configurations

Configuration 1 (hide)

cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*

History

09 Nov 2022, 03:12

Type Values Removed Values Added
References (MISC) https://blog.sonarsource.com/grav-cms-code-execution-vulnerabilities - (MISC) https://blog.sonarsource.com/grav-cms-code-execution-vulnerabilities - Exploit, Third Party Advisory

02 Aug 2022, 16:15

Type Values Removed Values Added
References
  • (MISC) https://blog.sonarsource.com/grav-cms-code-execution-vulnerabilities -

08 Jun 2021, 19:22

Type Values Removed Values Added
References (MISC) http://packetstormsecurity.com/files/162987/Grav-CMS-1.7.10-Server-Side-Template-Injection.html - (MISC) http://packetstormsecurity.com/files/162987/Grav-CMS-1.7.10-Server-Side-Template-Injection.html - Exploit, Third Party Advisory, VDB Entry

07 Jun 2021, 16:15

Type Values Removed Values Added
References
  • (MISC) http://packetstormsecurity.com/files/162987/Grav-CMS-1.7.10-Server-Side-Template-Injection.html -

Information

Published : 2021-04-13 20:15

Updated : 2024-02-04 21:47


NVD link : CVE-2021-29440

Mitre link : CVE-2021-29440

CVE.ORG link : CVE-2021-29440


JSON object : View

Products Affected

getgrav

  • grav
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')