Vulnerabilities > CVE-2021-29440 - Unspecified vulnerability in Getgrav Grav

CVSS 7.2 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

HIGH

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

getgrav

NVD

Published: 2021-04-13

Updated: 2024-11-21

Summary

Grav is a file based Web-platform. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance. The issue was addressed in version 1.7.11.

Vulnerable Configurations

Part	Description	Count
Application	Getgrav Getgrav Grav 0.1.0 Getgrav Grav 0.1.1 Getgrav Grav 0.2.0 Getgrav Grav 0.3.0 Getgrav Grav 0.8.0 Getgrav Grav 0.9.0 Getgrav Grav 0.9.1 Getgrav Grav 0.9.2 Getgrav Grav 0.9.3 Getgrav Grav 0.9.4 Getgrav Grav 0.9.5 Getgrav Grav 0.9.6 Getgrav Grav 0.9.7 Getgrav Grav 0.9.8 Getgrav Grav 0.9.9 Getgrav Grav 0.9.10 Getgrav Grav 0.9.11 Getgrav Grav 0.9.12 Getgrav Grav 0.9.13 Getgrav Grav 0.9.14 Getgrav Grav 0.9.15 Getgrav Grav 0.9.16 Getgrav Grav 0.9.17 Getgrav Grav 0.9.18 Getgrav Grav 0.9.19 Getgrav Grav 0.9.20 Getgrav Grav 0.9.21 Getgrav Grav 0.9.22 Getgrav Grav 0.9.23 Getgrav Grav 0.9.24 Getgrav Grav 0.9.25 Getgrav Grav 0.9.26 Getgrav Grav 0.9.27 Getgrav Grav 0.9.28 Getgrav Grav 0.9.29 Getgrav Grav 0.9.30 Getgrav Grav 0.9.31 Getgrav Grav 0.9.32 Getgrav Grav 0.9.33 Getgrav Grav 0.9.34 Getgrav Grav 0.9.35 Getgrav Grav 0.9.36 Getgrav Grav 0.9.37 Getgrav Grav 0.9.38 Getgrav Grav 0.9.39 Getgrav Grav 0.9.40 Getgrav Grav 0.9.41 Getgrav Grav 0.9.42 Getgrav Grav 0.9.43 Getgrav Grav 0.9.44 Getgrav Grav 0.9.45 Getgrav Grav 1.0.0 Getgrav Grav 1.0.1 Getgrav Grav 1.0.2 Getgrav Grav 1.0.3 Getgrav Grav 1.0.4 Getgrav Grav 1.0.5 Getgrav Grav 1.0.6 Getgrav Grav 1.0.7 Getgrav Grav 1.0.8 Getgrav Grav 1.0.9 Getgrav Grav 1.0.10 Getgrav Grav 1.1.0 Getgrav Grav 1.1.1 Getgrav Grav 1.1.2 Getgrav Grav 1.1.3 Getgrav Grav 1.1.4 Getgrav Grav 1.1.5 Getgrav Grav 1.1.6 Getgrav Grav 1.1.7 Getgrav Grav 1.1.8 Getgrav Grav 1.1.9 Getgrav Grav 1.1.10 Getgrav Grav 1.1.11 Getgrav Grav 1.1.12 Getgrav Grav 1.1.13 Getgrav Grav 1.1.14 Getgrav Grav 1.1.15 Getgrav Grav 1.1.16 Getgrav Grav 1.1.17 Getgrav Grav 1.2.0 Getgrav Grav 1.2.1 Getgrav Grav 1.2.2 Getgrav Grav 1.2.3 Getgrav Grav 1.2.4 Getgrav Grav 1.3.0 Getgrav Grav 1.3.1 Getgrav Grav 1.3.2 Getgrav Grav 1.3.3 Getgrav Grav 1.3.4 Getgrav Grav 1.3.5 Getgrav Grav 1.3.6 Getgrav Grav 1.3.7 Getgrav Grav 1.3.8 Getgrav Grav 1.3.9 Getgrav Grav 1.3.10 Getgrav Grav 1.4.0 Getgrav Grav 1.4.1 Getgrav Grav 1.4.2 Getgrav Grav 1.4.3 Getgrav Grav 1.4.4 Getgrav Grav 1.4.5 Getgrav Grav 1.4.6 Getgrav Grav 1.4.7 Getgrav Grav 1.4.8 Getgrav Grav 1.5.0 Getgrav Grav 1.5.1 Getgrav Grav 1.5.2 Getgrav Grav 1.5.3 Getgrav Grav 1.5.4 Getgrav Grav 1.5.5 Getgrav Grav 1.5.6 Getgrav Grav 1.5.7 Getgrav Grav 1.5.8 Getgrav Grav 1.5.9 Getgrav Grav 1.5.10 Getgrav Grav 1.6.0 Getgrav Grav 1.6.1 Getgrav Grav 1.6.2 Getgrav Grav 1.6.3 Getgrav Grav 1.6.4 Getgrav Grav 1.6.5 Getgrav Grav 1.6.6 Getgrav Grav 1.6.7 Getgrav Grav 1.6.8 Getgrav Grav 1.6.9 Getgrav Grav 1.6.10 Getgrav Grav 1.6.11 Getgrav Grav 1.6.12 Getgrav Grav 1.6.13 Getgrav Grav 1.6.14 Getgrav Grav 1.6.15 Getgrav Grav 1.6.16 Getgrav Grav 1.6.17 Getgrav Grav 1.6.18 Getgrav Grav 1.6.19 Getgrav Grav 1.6.20 Getgrav Grav 1.6.21 Getgrav Grav 1.6.22 Getgrav Grav 1.6.23 Getgrav Grav 1.6.24 Getgrav Grav 1.6.25 Getgrav Grav 1.6.26 Getgrav Grav 1.6.27 Getgrav Grav 1.6.28 Getgrav Grav 1.6.29 Getgrav Grav 1.6.30 Getgrav Grav 1.6.31 Getgrav Grav 1.7.0 Getgrav Grav 1.7.1 Getgrav Grav 1.7.3 Getgrav Grav 1.7.4 Getgrav Grav 1.7.5 Getgrav Grav 1.7.6 Getgrav Grav 1.7.7 Getgrav Grav 1.7.8 Getgrav Grav 1.7.9 Getgrav Grav 1.7.10	233

Summary

Vulnerable Configurations

References