~ / search / GHSA-735v-wx75-xmmm

GHSA-735v-wx75-xmmm

Cross-site Scripting in grav

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-0268

Packages

EcosystemPackageAffectedFixed in
Packagist getgrav/grav < 1.7.28 1.7.28

Details

As written in the advisory (Markdown source, shown as plain text).

In grav prior to version 1.7.28, a low privilege user can create a page with arbitrary javascript by bypassing insufficent XSS filtering.

References

External links from the advisory. They lead to third-party sites.