Threat Investigation
Request a demo

CVE-2024-27923

High

Description

Grav is a content management system (CMS). Prior to version 1.7.43, users who may write a page may use the `frontmatter` feature due to insufficient permission validation and inadequate file name validation. This may lead to remote code execution. Version 1.7.43 fixes this issue.

SeverityHigh
CVSS8.8
Exploit probability—
ProductGrav
PublishedMar 21, 2024
First seenMar 21, 2024
Weakness typeCWE-287Improper authenticationCWE-434Unrestricted upload of dangerous file type

How to fix

Update
  • getgrav grav1.7.43 or later
  • getgrav/grav1.7.43 or later

Affected products

ProductAffected versionsFixed in
getgrav gravv < 1.7.431.7.43
getgrav/gravPackagistv < 1.7.431.7.43

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.