Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
Grav CMS Unauthenticated RCE (CVE-2021-21425) - Vulnerability Database

Grav CMS Unauthenticated RCE (CVE-2021-21425)

Description

Invicti has detected that the web application is based on Grav CMS. Grav Admin Plugin has a vulnerability that allows an unauthenticated user to execute some methods of administrator controller without needing any credentials. An attacker can use it to achieve RCE on the server.

Remediation

Upgrade to the latest version of Grav CMS

References

GravCMS Unauthenticated Arbitrary YAML Write/Update leads to Code Execution

Related Vulnerabilities

MongoDB $where operator JavaScript injection High
Common tags: Code Execution Known Vulnerabilities
TinyMCE ajax_create_folder remote code execution vulnerability High
Common tags: Code Execution Known Vulnerabilities
timthumb.php remote code execution High
Common tags: Code Execution Known Vulnerabilities
Ivanti EPM SQLi RCE (CVE-2024-29824) High
Common tags: Code Execution Known Vulnerabilities
Ivanti CSA Path Traversal (CVE-2024-8963/CVE-2024-8190) Critical
Common tags: Code Execution Known Vulnerabilities

Severity

High

Classification

CVE-2021-21425
CWE-284
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Code Execution
Known Vulnerabilities