CVE-2020-29555

Опубликовано: 15 мар. 2021

Источник: nvd

CVSS3: 8.1

CVSS2: 5.5

EPSS Низкий

Описание

The BackupDelete functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to delete arbitrary files on the underlying server by exploiting a path-traversal technique. (This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection.)

Ссылки

https://blog.bssi.fr/cve-2020-29553-cve-2020-29555-cve-2020-29556-multiple-vulnerabilities-within-cms-grav/
Exploit
Patch
Third Party Advisory
https://blog.bssi.fr/cve-2020-29553-cve-2020-29555-cve-2020-29556-multiple-vulnerabilities-within-cms-grav/
Exploit
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:getgrav:grav_cms:*:*:*:*:*:*:*:*

Версия до 1.7.0 (исключая)

cpe:2.3:a:getgrav:grav_cms:1.7.0:beta1:*:*:*:*:*:*

cpe:2.3:a:getgrav:grav_cms:1.7.0:beta10:*:*:*:*:*:*

cpe:2.3:a:getgrav:grav_cms:1.7.0:beta2:*:*:*:*:*:*

cpe:2.3:a:getgrav:grav_cms:1.7.0:beta3:*:*:*:*:*:*

cpe:2.3:a:getgrav:grav_cms:1.7.0:beta4:*:*:*:*:*:*

cpe:2.3:a:getgrav:grav_cms:1.7.0:beta5:*:*:*:*:*:*

cpe:2.3:a:getgrav:grav_cms:1.7.0:beta6:*:*:*:*:*:*

cpe:2.3:a:getgrav:grav_cms:1.7.0:beta7:*:*:*:*:*:*

cpe:2.3:a:getgrav:grav_cms:1.7.0:beta8:*:*:*:*:*:*

cpe:2.3:a:getgrav:grav_cms:1.7.0:beta9:*:*:*:*:*:*

cpe:2.3:a:getgrav:grav_cms:1.7.0:rc1:*:*:*:*:*:*

cpe:2.3:a:getgrav:grav_cms:1.7.0:rc10:*:*:*:*:*:*

cpe:2.3:a:getgrav:grav_cms:1.7.0:rc11:*:*:*:*:*:*

cpe:2.3:a:getgrav:grav_cms:1.7.0:rc12:*:*:*:*:*:*

cpe:2.3:a:getgrav:grav_cms:1.7.0:rc13:*:*:*:*:*:*

cpe:2.3:a:getgrav:grav_cms:1.7.0:rc14:*:*:*:*:*:*

cpe:2.3:a:getgrav:grav_cms:1.7.0:rc15:*:*:*:*:*:*

cpe:2.3:a:getgrav:grav_cms:1.7.0:rc16:*:*:*:*:*:*

cpe:2.3:a:getgrav:grav_cms:1.7.0:rc17:*:*:*:*:*:*

cpe:2.3:a:getgrav:grav_cms:1.7.0:rc2:*:*:*:*:*:*

cpe:2.3:a:getgrav:grav_cms:1.7.0:rc20:*:*:*:*:*:*

cpe:2.3:a:getgrav:grav_cms:1.7.0:rc3:*:*:*:*:*:*

cpe:2.3:a:getgrav:grav_cms:1.7.0:rc4:*:*:*:*:*:*

cpe:2.3:a:getgrav:grav_cms:1.7.0:rc5:*:*:*:*:*:*

cpe:2.3:a:getgrav:grav_cms:1.7.0:rc6:*:*:*:*:*:*

cpe:2.3:a:getgrav:grav_cms:1.7.0:rc7:*:*:*:*:*:*

cpe:2.3:a:getgrav:grav_cms:1.7.0:rc8:*:*:*:*:*:*

cpe:2.3:a:getgrav:grav_cms:1.7.0:rc9:*:*:*:*:*:*

EPSS

Процентиль: 88%

0.04155

Низкий

8.1 High

CVSS3

5.5 Medium

CVSS2

Дефекты

CWE-22

Связанные уязвимости

GHSA-gpmf-q5jh-hjx4