CVE-2022-2073: Code injection in grav
Code Injection in GitHub repository getgrav/grav prior to 1.7.34.
Other sources
Grav is vulnerable to Server Side Template Injection via Twig. According to a previous vulnerability report, Twig should not render dangerous functions by default, such as system.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/getgrav/gravto a version that resolves this vulnerability.Fixed in 1.7.34
Event History
Frequently Asked Questions
What is CVE-2022-2073?
CVE-2022-2073 is a code injection vulnerability in the GitHub repository getgrav/grav prior to version 1.7.34.
How severe is CVE-2022-2073?
CVE-2022-2073 is classified as critical with a severity value of 7.2.
What software is affected by CVE-2022-2073?
The software affected by CVE-2022-2073 is Getgrav Grav prior to version 1.7.34.
How can I fix CVE-2022-2073?
To fix CVE-2022-2073, update your Getgrav Grav installation to version 1.7.34 or later.
Where can I find more information about CVE-2022-2073?
You can find more information about CVE-2022-2073 at the following references: [GitHub Commit](https://github.com/getgrav/grav/commit/9d6a2dba09fd4e56f5cdfb9a399caea355bfeb83) and [Huntr.dev Bounty](https://huntr.dev/bounties/3ef640e6-9e25-4ecb-8ec1-64311d63fe66).