Vulnerabilities > CVE-2021-21425 - Unspecified vulnerability in Getgrav Grav-Plugin-Admin

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

getgrav

critical

NVD

Published: 2021-04-07

Updated: 2022-10-24

Summary

Grav Admin Plugin is an HTML user interface that provides a way to configure Grav and create and modify pages. In versions 1.10.7 and earlier, an unauthenticated user can execute some methods of administrator controller without needing any credentials. Particular method execution will result in arbitrary YAML file creation or content change of existing YAML files on the system. Successfully exploitation of that vulnerability results in configuration changes, such as general site information change, custom scheduler job definition, etc. Due to the nature of the vulnerability, an adversary can change some part of the webpage, or hijack an administrator account, or execute operating system command under the context of the web-server user. This vulnerability is fixed in version 1.10.8. Blocking access to the `/admin` path from untrusted sources can be applied as a workaround.

Vulnerable Configurations

Part	Description	Count
Application	Getgrav Getgrav Grav Plugin Admin - Getgrav Grav Plugin Admin 0.1.0 Getgrav Grav Plugin Admin 0.1.1 Getgrav Grav Plugin Admin 0.2.0 Getgrav Grav Plugin Admin 0.3.0 Getgrav Grav Plugin Admin 0.4.0 Getgrav Grav Plugin Admin 0.4.1 Getgrav Grav Plugin Admin 0.4.2 Getgrav Grav Plugin Admin 0.4.3 Getgrav Grav Plugin Admin 0.5.0 Getgrav Grav Plugin Admin 0.6.0 Getgrav Grav Plugin Admin 0.6.1 Getgrav Grav Plugin Admin 0.6.2 Getgrav Grav Plugin Admin 1.0.0 Getgrav Grav Plugin Admin 1.0.1 Getgrav Grav Plugin Admin 1.0.2 Getgrav Grav Plugin Admin 1.0.3 Getgrav Grav Plugin Admin 1.0.4 Getgrav Grav Plugin Admin 1.0.5 Getgrav Grav Plugin Admin 1.0.6 Getgrav Grav Plugin Admin 1.0.7 Getgrav Grav Plugin Admin 1.0.8 Getgrav Grav Plugin Admin 1.0.9 Getgrav Grav Plugin Admin 1.0.10 Getgrav Grav Plugin Admin 1.1.0 Getgrav Grav Plugin Admin 1.1.1 Getgrav Grav Plugin Admin 1.1.2 Getgrav Grav Plugin Admin 1.1.3 Getgrav Grav Plugin Admin 1.1.4 Getgrav Grav Plugin Admin 1.2.0 Getgrav Grav Plugin Admin 1.2.1 Getgrav Grav Plugin Admin 1.2.2 Getgrav Grav Plugin Admin 1.2.3 Getgrav Grav Plugin Admin 1.2.4 Getgrav Grav Plugin Admin 1.2.5 Getgrav Grav Plugin Admin 1.2.6 Getgrav Grav Plugin Admin 1.2.7 Getgrav Grav Plugin Admin 1.2.8 Getgrav Grav Plugin Admin 1.2.9 Getgrav Grav Plugin Admin 1.2.10 Getgrav Grav Plugin Admin 1.2.11 Getgrav Grav Plugin Admin 1.2.12 Getgrav Grav Plugin Admin 1.2.13 Getgrav Grav Plugin Admin 1.2.14 Getgrav Grav Plugin Admin 1.3.0 Getgrav Grav Plugin Admin 1.3.1 Getgrav Grav Plugin Admin 1.3.2 Getgrav Grav Plugin Admin 1.3.3 Getgrav Grav Plugin Admin 1.4.0 Getgrav Grav Plugin Admin 1.4.1 Getgrav Grav Plugin Admin 1.4.2 Getgrav Grav Plugin Admin 1.5.0 Getgrav Grav Plugin Admin 1.5.1 Getgrav Grav Plugin Admin 1.5.2 Getgrav Grav Plugin Admin 1.6.0 Getgrav Grav Plugin Admin 1.6.1 Getgrav Grav Plugin Admin 1.6.2 Getgrav Grav Plugin Admin 1.6.3 Getgrav Grav Plugin Admin 1.6.4 Getgrav Grav Plugin Admin 1.6.5 Getgrav Grav Plugin Admin 1.6.6 Getgrav Grav Plugin Admin 1.6.7 Getgrav Grav Plugin Admin 1.7.0 Getgrav Grav Plugin Admin 1.7.1 Getgrav Grav Plugin Admin 1.7.2 Getgrav Grav Plugin Admin 1.7.3 Getgrav Grav Plugin Admin 1.7.4 Getgrav Grav Plugin Admin 1.8.0 Getgrav Grav Plugin Admin 1.8.1 Getgrav Grav Plugin Admin 1.8.2 Getgrav Grav Plugin Admin 1.8.3 Getgrav Grav Plugin Admin 1.8.4 Getgrav Grav Plugin Admin 1.8.5 Getgrav Grav Plugin Admin 1.8.6 Getgrav Grav Plugin Admin 1.8.7 Getgrav Grav Plugin Admin 1.8.8 Getgrav Grav Plugin Admin 1.8.9 Getgrav Grav Plugin Admin 1.8.10 Getgrav Grav Plugin Admin 1.8.11 Getgrav Grav Plugin Admin 1.8.12 Getgrav Grav Plugin Admin 1.8.13 Getgrav Grav Plugin Admin 1.8.14 Getgrav Grav Plugin Admin 1.8.15 Getgrav Grav Plugin Admin 1.8.16 Getgrav Grav Plugin Admin 1.8.17 Getgrav Grav Plugin Admin 1.8.18 Getgrav Grav Plugin Admin 1.8.19 Getgrav Grav Plugin Admin 1.8.20 Getgrav Grav Plugin Admin 1.9.0 Getgrav Grav Plugin Admin 1.9.1 Getgrav Grav Plugin Admin 1.9.2 Getgrav Grav Plugin Admin 1.9.3 Getgrav Grav Plugin Admin 1.9.4 Getgrav Grav Plugin Admin 1.9.5 Getgrav Grav Plugin Admin 1.9.6 Getgrav Grav Plugin Admin 1.9.7 Getgrav Grav Plugin Admin 1.9.8 Getgrav Grav Plugin Admin 1.9.9 Getgrav Grav Plugin Admin 1.9.10 Getgrav Grav Plugin Admin 1.9.11 Getgrav Grav Plugin Admin 1.9.12 Getgrav Grav Plugin Admin 1.9.13 Getgrav Grav Plugin Admin 1.9.14 Getgrav Grav Plugin Admin 1.9.15 Getgrav Grav Plugin Admin 1.9.16 Getgrav Grav Plugin Admin 1.9.17 Getgrav Grav Plugin Admin 1.9.18 Getgrav Grav Plugin Admin 1.9.19 Getgrav Grav Plugin Admin 1.10.0 Getgrav Grav Plugin Admin 1.10.1 Getgrav Grav Plugin Admin 1.10.2 Getgrav Grav Plugin Admin 1.10.3 Getgrav Grav Plugin Admin 1.10.4 Getgrav Grav Plugin Admin 1.10.5 Getgrav Grav Plugin Admin 1.10.6 Getgrav Grav Plugin Admin 1.10.7	191

Summary

Vulnerable Configurations

References