GitHub Advisoryadvisory · Packagist

GHSA-cg3q-59w7-rvc2 Reliance on Cookies without Validation and Integrity Checking in getgrav/grav

MEDIUM Published 2021-09-29 Modified 2021-09-28 Official page ↗
Aliases
CVE-2021-3818
Ecosystem
Packagist
Packages
getgrav/grav
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-565
Reviewed
2021-09-28

Affected packages

• Packagist getgrav/grav: < 1.7.21 → fixed in 1.7.21

Description

grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking. A cookie with an overly broad path can be accessed through other applications on the same domain. Since cookies often carry sensitive information such as session identifiers, sharing cookies across applications can lead a vulnerability in one application to cause a compromise in another.

Related

Alias · CVE (1)

  • CVE-2021-3818 grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking vulnerability

Weakness · CWE (1)

  • CWE-565 Reliance on Cookies without Validation and Integrity Checking weakness

References