GitHub Advisoryadvisory · Packagist

GHSA-cxgw-r5jg-7xwq Code injection in grav

HIGH Published 2022-06-30 Modified 2022-07-11 Official page ↗
Aliases
CVE-2022-2073
Ecosystem
Packagist
Packages
getgrav/grav
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2022-07-05

Affected packages

• Packagist getgrav/grav: < 1.7.34 → fixed in 1.7.34

Description

Grav is vulnerable to Server Side Template Injection via Twig. According to a previous vulnerability report, Twig should not render dangerous functions by default, such as system.

Related

Alias · CVE (1)

  • CVE-2022-2073 Code Injection in GitHub repository getgrav/grav prior to 1.7.34. vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References