Description

Acunetix has detected that the web application is based on Grav CMS. Grav Admin Plugin has a vulnerability that allows an unauthenticated user to execute some methods of administrator controller without needing any credentials. An attacker can use it to achieve RCE on the server.

Remediation

Upgrade to the latest version of Grav CMS

References

GravCMS Unauthenticated Arbitrary YAML Write/Update leads to Code Execution

Related Vulnerabilities

Liferay version older than 7.0

WordPress Plugin Flamingo Code Injection (1.1)

Atlassian Crowd Remote Code Execution

WordPress Plugin wSecure Lite Remote Code Execution (2.3)

WordPress Plugin CM Download Manager Code Injection (2.0.3)

Severity

High

Classification

CWE-284 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Code Execution