CVE-2024-27923
CVSS 3.1 Score 8.8 of 10 (high)
Details
Published Mar 21, 2024
Updated: Jan 2, 2025
CWE ID 434
CWE ID 287
Summary
CVE-2024-27923 is a vulnerability affecting the Grav content management system. Before version 1.7.43, the platform failed to adequately validate user permissions for the `frontmatter` feature and did not properly check file names. This deficiency could enable remote code execution for users who can write pages. The issue has been resolved in version 1.7.43 through proper access control and file name validation enhancements.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Getgrav Grav