Description (CNA)
Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions delete, approve, and approveAll. Authenticated Admin users lacking the admin.guestbook permission, or external sites abusing a moderator's session via nonce-less GET requests, can delete or approve Guestbook entries.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| getgrav / grav-plugin-guestbook | affected 0.5.0 before 0.5.2; unaffected 0.5.2 |
CWE
CWE-862
References
- https://github.com/getgrav/grav/security/advisories/GHSA-wxr7-h5mm-c7mv
- https://www.vulncheck.com/advisories/grav-guestbook-plugin-0.5.0-and-0.5.1-missing-authorization-and-csrf-in-moderation
ADP enrichment
No English description supplied.
No references supplied.