SB2024051540 - Improper access control in Grav CMS

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024051540

SB2024051540 - Improper access control in Grav CMS

Published: May 15, 2024 Updated: May 5, 2026

Security Bulletin ID SB2024051540
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper access control (CVE-ID: CVE-2024-34082)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the Twig template processing functionality when rendering user-supplied page content. A remote user can inject Twig syntax that reads arbitrary server files to disclose sensitive information.

Exploitation requires a low-privilege account with page edit privilege. Exposed account files may contain hashed passwords, 2FA secrets, and password reset tokens, which can enable account takeover of other users.


Remediation

Install update from vendor's website.

References