CVE-2020-29553: CSRF

Q: What is CVE-2020-29553?

CVE-2020-29553 is a vulnerability in the scheduler of Grav CMS through 1.7.0-rc.17 that allows an attacker to execute a system command by tricking an admin into visiting a malicious website (CSRF).

Q: How severe is CVE-2020-29553?

CVE-2020-29553 has a severity score of 8.8 (high).

Q: What software is affected by CVE-2020-29553?

Grav CMS versions 1.6.31 and 1.7.0-beta1 to 1.7.0-rc17 are affected by CVE-2020-29553.

Q: How can the CVE-2020-29553 vulnerability be fixed?

To fix the CVE-2020-29553 vulnerability, users should update Grav CMS to version 1.7.1 or later.

Q: Where can I find more information about CVE-2020-29553?

You can find more information about CVE-2020-29553 at this reference: https://blog.bssi.fr/cve-2020-29553-cve-2020-29555-cve-2020-29556-multiple-vulnerabilities-within-cms-grav/

Published Mar 15, 2021

Updated

The Scheduler in Grav CMS through 1.7.0-rc.17 allows an attacker to execute a system command by tricking an admin into visiting a malicious website (CSRF).

Affected Software

30 affected componentsFixes available

composer/getgrav/grav<1.6.30

1.6.30

composer/getgrav/grav>=1.7.0-beta.1<=1.7.0-rc.17

getgrav Grav Cms<=1.6.31

getgrav Grav Cms=1.7.0-beta1

getgrav Grav Cms=1.7.0-beta10

getgrav Grav Cms=1.7.0-beta2

getgrav Grav Cms=1.7.0-beta3

getgrav Grav Cms=1.7.0-beta4

getgrav Grav Cms=1.7.0-beta5

getgrav Grav Cms=1.7.0-beta6

getgrav Grav Cms=1.7.0-beta7

getgrav Grav Cms=1.7.0-beta8

getgrav Grav Cms=1.7.0-beta9

getgrav Grav Cms=1.7.0-rc1

getgrav Grav Cms=1.7.0-rc10

getgrav Grav Cms=1.7.0-rc11

getgrav Grav Cms=1.7.0-rc12

getgrav Grav Cms=1.7.0-rc13

getgrav Grav Cms=1.7.0-rc14

getgrav Grav Cms=1.7.0-rc15

getgrav Grav Cms=1.7.0-rc16

getgrav Grav Cms=1.7.0-rc17

getgrav Grav Cms=1.7.0-rc2

getgrav Grav Cms=1.7.0-rc3

getgrav Grav Cms=1.7.0-rc4

getgrav Grav Cms=1.7.0-rc5

getgrav Grav Cms=1.7.0-rc6

getgrav Grav Cms=1.7.0-rc7

getgrav Grav Cms=1.7.0-rc8

getgrav Grav Cms=1.7.0-rc9

Event History

Mar 15, 2021

CVE Published

via MITRE·06:20 PM

Data Sourced

via MITRE·06:20 PM

Description

May 24, 2022

Advisory Published

via GitHub·05:44 PM

Frequently Asked Questions

What is CVE-2020-29553?

CVE-2020-29553 is a vulnerability in the scheduler of Grav CMS through 1.7.0-rc.17 that allows an attacker to execute a system command by tricking an admin into visiting a malicious website (CSRF).

How severe is CVE-2020-29553?

CVE-2020-29553 has a severity score of 8.8 (high).

What software is affected by CVE-2020-29553?