CVE-2024-27923CWE-287CWE-434

Remote Code Execution by uploading a phar file using frontmatter

High · published March 6, 2024

CVSS v3.1
8.8
EPSS
1%
Percentile
71.5
In the wild
Unconfirmed
What it is

Grav is a content management system (CMS). Prior to version 1.7.43, users who may write a page may use the `frontmatter` feature due to insufficient permission validation and inadequate file name validation. This may lead to remote code execution. Version 1.7.43 fixes this issue.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01357 · 71.5th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2024-03-06T20:28Z
EPSS history
Timeline
  • 06 MAR 20:28Z
    Remote Code Execution by uploading a phar file using frontmatter
    cvelistv5