Description (CNA)
The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler (processUserProfile(), the update_user task). Unlike the registration handler, this handler does not strip privilege fields ('groups','access') from user-submitted form data before persisting them. When an administrator has added 'groups' and/or 'access' to plugins.login.user_registration.fields and the default 'regular'/DataUser account backend is in use, a low-privilege authenticated user can POST crafted profile form data (e.g. access[admin][super]=true) to escalate to super-admin, enabling admin panel access, scheduler abuse (RCE), and Twig evaluation. Fixed in 3.8.12.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| getgrav / grav | affected 0 before 3.8.12; unaffected 3.8.12 |
CWE
CWE-269
References
- https://github.com/getgrav/grav/security/advisories/GHSA-h33v-82r9-v8pm
- https://www.vulncheck.com/advisories/grav-login-plugin-privilege-escalation-via-profile-update
ADP enrichment
No English description supplied.