Shodan
Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2023-34252

Grav is a flat-file content management system. Prior to version 1.7.42, there is a logic flaw in the `GravExtension.filterFilter()` function whereby validation against a denylist of unsafe functions is only performed when the argument passed to filter is a string. However, passing an array as a callable argument allows the validation check to be skipped. Consequently, a low privileged attacker with login access to Grav Admin panel and page creation/update permissions is able to inject malicious templates to obtain remote code execution. The vulnerability can be found in the `GravExtension.filterFilter()` function declared in `/system/src/Grav/Common/Twig/Extension/GravExtension.php`. Version 1.7.42 contains a patch for this issue. End users should also ensure that `twig.undefined_functions` and `twig.undefined_filters` properties in `/path/to/webroot/system/config/system.yaml` configuration file are set to `false` to disallow Twig from treating undefined filters/functions as PHP functions and executing them.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 60.7%
CVSS Severity
CVSS v3 Score 8.8
Products affected by CVE-2023-34252
  • Getgrav » Grav » Version: 0.1.0
    cpe:2.3:a:getgrav:grav:0.1.0
  • Getgrav » Grav » Version: 0.1.1
    cpe:2.3:a:getgrav:grav:0.1.1
  • Getgrav » Grav » Version: 0.2.0
    cpe:2.3:a:getgrav:grav:0.2.0
  • Getgrav » Grav » Version: 0.3.0
    cpe:2.3:a:getgrav:grav:0.3.0
  • Getgrav » Grav » Version: 0.8.0
    cpe:2.3:a:getgrav:grav:0.8.0
  • Getgrav » Grav » Version: 0.9.0
    cpe:2.3:a:getgrav:grav:0.9.0
  • Getgrav » Grav » Version: 0.9.1
    cpe:2.3:a:getgrav:grav:0.9.1
  • Getgrav » Grav » Version: 0.9.10
    cpe:2.3:a:getgrav:grav:0.9.10
  • Getgrav » Grav » Version: 0.9.11
    cpe:2.3:a:getgrav:grav:0.9.11
  • Getgrav » Grav » Version: 0.9.12
    cpe:2.3:a:getgrav:grav:0.9.12
  • Getgrav » Grav » Version: 0.9.13
    cpe:2.3:a:getgrav:grav:0.9.13
  • Getgrav » Grav » Version: 0.9.14
    cpe:2.3:a:getgrav:grav:0.9.14
  • Getgrav » Grav » Version: 0.9.15
    cpe:2.3:a:getgrav:grav:0.9.15
  • Getgrav » Grav » Version: 0.9.16
    cpe:2.3:a:getgrav:grav:0.9.16
  • Getgrav » Grav » Version: 0.9.17
    cpe:2.3:a:getgrav:grav:0.9.17
  • Getgrav » Grav » Version: 0.9.18
    cpe:2.3:a:getgrav:grav:0.9.18
  • Getgrav » Grav » Version: 0.9.19
    cpe:2.3:a:getgrav:grav:0.9.19
  • Getgrav » Grav » Version: 0.9.2
    cpe:2.3:a:getgrav:grav:0.9.2
  • Getgrav » Grav » Version: 0.9.20
    cpe:2.3:a:getgrav:grav:0.9.20
  • Getgrav » Grav » Version: 0.9.21
    cpe:2.3:a:getgrav:grav:0.9.21
  • Getgrav » Grav » Version: 0.9.22
    cpe:2.3:a:getgrav:grav:0.9.22
  • Getgrav » Grav » Version: 0.9.23
    cpe:2.3:a:getgrav:grav:0.9.23
  • Getgrav » Grav » Version: 0.9.24
    cpe:2.3:a:getgrav:grav:0.9.24
  • Getgrav » Grav » Version: 0.9.25
    cpe:2.3:a:getgrav:grav:0.9.25
  • Getgrav » Grav » Version: 0.9.26
    cpe:2.3:a:getgrav:grav:0.9.26
  • Getgrav » Grav » Version: 0.9.27
    cpe:2.3:a:getgrav:grav:0.9.27
  • Getgrav » Grav » Version: 0.9.28
    cpe:2.3:a:getgrav:grav:0.9.28
  • Getgrav » Grav » Version: 0.9.29
    cpe:2.3:a:getgrav:grav:0.9.29
  • Getgrav » Grav » Version: 0.9.3
    cpe:2.3:a:getgrav:grav:0.9.3
  • Getgrav » Grav » Version: 0.9.30
    cpe:2.3:a:getgrav:grav:0.9.30
  • Getgrav » Grav » Version: 0.9.31
    cpe:2.3:a:getgrav:grav:0.9.31
  • Getgrav » Grav » Version: 0.9.32
    cpe:2.3:a:getgrav:grav:0.9.32
  • Getgrav » Grav » Version: 0.9.33
    cpe:2.3:a:getgrav:grav:0.9.33
  • Getgrav » Grav » Version: 0.9.34
    cpe:2.3:a:getgrav:grav:0.9.34
  • Getgrav » Grav » Version: 0.9.35
    cpe:2.3:a:getgrav:grav:0.9.35
  • Getgrav » Grav » Version: 0.9.36
    cpe:2.3:a:getgrav:grav:0.9.36
  • Getgrav » Grav » Version: 0.9.37
    cpe:2.3:a:getgrav:grav:0.9.37
  • Getgrav » Grav » Version: 0.9.38
    cpe:2.3:a:getgrav:grav:0.9.38
  • Getgrav » Grav » Version: 0.9.39
    cpe:2.3:a:getgrav:grav:0.9.39
  • Getgrav » Grav » Version: 0.9.4
    cpe:2.3:a:getgrav:grav:0.9.4
  • Getgrav » Grav » Version: 0.9.40
    cpe:2.3:a:getgrav:grav:0.9.40
  • Getgrav » Grav » Version: 0.9.41
    cpe:2.3:a:getgrav:grav:0.9.41
  • Getgrav » Grav » Version: 0.9.42
    cpe:2.3:a:getgrav:grav:0.9.42
  • Getgrav » Grav » Version: 0.9.43
    cpe:2.3:a:getgrav:grav:0.9.43
  • Getgrav » Grav » Version: 0.9.44
    cpe:2.3:a:getgrav:grav:0.9.44
  • Getgrav » Grav » Version: 0.9.45
    cpe:2.3:a:getgrav:grav:0.9.45
  • Getgrav » Grav » Version: 0.9.5
    cpe:2.3:a:getgrav:grav:0.9.5
  • Getgrav » Grav » Version: 0.9.6
    cpe:2.3:a:getgrav:grav:0.9.6
  • Getgrav » Grav » Version: 0.9.7
    cpe:2.3:a:getgrav:grav:0.9.7
  • Getgrav » Grav » Version: 0.9.8
    cpe:2.3:a:getgrav:grav:0.9.8
  • Getgrav » Grav » Version: 0.9.9
    cpe:2.3:a:getgrav:grav:0.9.9
  • Getgrav » Grav » Version: 1.0.0
    cpe:2.3:a:getgrav:grav:1.0.0
  • Getgrav » Grav » Version: 1.0.1
    cpe:2.3:a:getgrav:grav:1.0.1
  • Getgrav » Grav » Version: 1.0.10
    cpe:2.3:a:getgrav:grav:1.0.10
  • Getgrav » Grav » Version: 1.0.2
    cpe:2.3:a:getgrav:grav:1.0.2
  • Getgrav » Grav » Version: 1.0.3
    cpe:2.3:a:getgrav:grav:1.0.3
  • Getgrav » Grav » Version: 1.0.4
    cpe:2.3:a:getgrav:grav:1.0.4
  • Getgrav » Grav » Version: 1.0.5
    cpe:2.3:a:getgrav:grav:1.0.5
  • Getgrav » Grav » Version: 1.0.6
    cpe:2.3:a:getgrav:grav:1.0.6
  • Getgrav » Grav » Version: 1.0.7
    cpe:2.3:a:getgrav:grav:1.0.7
  • Getgrav » Grav » Version: 1.0.8
    cpe:2.3:a:getgrav:grav:1.0.8
  • Getgrav » Grav » Version: 1.0.9
    cpe:2.3:a:getgrav:grav:1.0.9
  • Getgrav » Grav » Version: 1.1.0
    cpe:2.3:a:getgrav:grav:1.1.0
  • Getgrav » Grav » Version: 1.1.1
    cpe:2.3:a:getgrav:grav:1.1.1
  • Getgrav » Grav » Version: 1.1.10
    cpe:2.3:a:getgrav:grav:1.1.10
  • Getgrav » Grav » Version: 1.1.11
    cpe:2.3:a:getgrav:grav:1.1.11
  • Getgrav » Grav » Version: 1.1.12
    cpe:2.3:a:getgrav:grav:1.1.12
  • Getgrav » Grav » Version: 1.1.13
    cpe:2.3:a:getgrav:grav:1.1.13
  • Getgrav » Grav » Version: 1.1.14
    cpe:2.3:a:getgrav:grav:1.1.14
  • Getgrav » Grav » Version: 1.1.15
    cpe:2.3:a:getgrav:grav:1.1.15
  • Getgrav » Grav » Version: 1.1.16
    cpe:2.3:a:getgrav:grav:1.1.16
  • Getgrav » Grav » Version: 1.1.17
    cpe:2.3:a:getgrav:grav:1.1.17
  • Getgrav » Grav » Version: 1.1.2
    cpe:2.3:a:getgrav:grav:1.1.2
  • Getgrav » Grav » Version: 1.1.3
    cpe:2.3:a:getgrav:grav:1.1.3
  • Getgrav » Grav » Version: 1.1.4
    cpe:2.3:a:getgrav:grav:1.1.4
  • Getgrav » Grav » Version: 1.1.5
    cpe:2.3:a:getgrav:grav:1.1.5
  • Getgrav » Grav » Version: 1.1.6
    cpe:2.3:a:getgrav:grav:1.1.6
  • Getgrav » Grav » Version: 1.1.7
    cpe:2.3:a:getgrav:grav:1.1.7
  • Getgrav » Grav » Version: 1.1.8
    cpe:2.3:a:getgrav:grav:1.1.8
  • Getgrav » Grav » Version: 1.1.9
    cpe:2.3:a:getgrav:grav:1.1.9
  • Getgrav » Grav » Version: 1.2.0
    cpe:2.3:a:getgrav:grav:1.2.0
  • Getgrav » Grav » Version: 1.2.1
    cpe:2.3:a:getgrav:grav:1.2.1
  • Getgrav » Grav » Version: 1.2.2
    cpe:2.3:a:getgrav:grav:1.2.2
  • Getgrav » Grav » Version: 1.2.3
    cpe:2.3:a:getgrav:grav:1.2.3
  • Getgrav » Grav » Version: 1.2.4
    cpe:2.3:a:getgrav:grav:1.2.4
  • Getgrav » Grav » Version: 1.3.0
    cpe:2.3:a:getgrav:grav:1.3.0
  • Getgrav » Grav » Version: 1.3.1
    cpe:2.3:a:getgrav:grav:1.3.1
  • Getgrav » Grav » Version: 1.3.10
    cpe:2.3:a:getgrav:grav:1.3.10
  • Getgrav » Grav » Version: 1.3.2
    cpe:2.3:a:getgrav:grav:1.3.2
  • Getgrav » Grav » Version: 1.3.3
    cpe:2.3:a:getgrav:grav:1.3.3
  • Getgrav » Grav » Version: 1.3.4
    cpe:2.3:a:getgrav:grav:1.3.4
  • Getgrav » Grav » Version: 1.3.5
    cpe:2.3:a:getgrav:grav:1.3.5
  • Getgrav » Grav » Version: 1.3.6
    cpe:2.3:a:getgrav:grav:1.3.6
  • Getgrav » Grav » Version: 1.3.7
    cpe:2.3:a:getgrav:grav:1.3.7
  • Getgrav » Grav » Version: 1.3.8
    cpe:2.3:a:getgrav:grav:1.3.8
  • Getgrav » Grav » Version: 1.3.9
    cpe:2.3:a:getgrav:grav:1.3.9
  • Getgrav » Grav » Version: 1.4.0
    cpe:2.3:a:getgrav:grav:1.4.0
  • Getgrav » Grav » Version: 1.4.1
    cpe:2.3:a:getgrav:grav:1.4.1
  • Getgrav » Grav » Version: 1.4.2
    cpe:2.3:a:getgrav:grav:1.4.2
  • Getgrav » Grav » Version: 1.4.3
    cpe:2.3:a:getgrav:grav:1.4.3
  • Getgrav » Grav » Version: 1.4.4
    cpe:2.3:a:getgrav:grav:1.4.4
  • Getgrav » Grav » Version: 1.4.5
    cpe:2.3:a:getgrav:grav:1.4.5
  • Getgrav » Grav » Version: 1.4.6
    cpe:2.3:a:getgrav:grav:1.4.6
  • Getgrav » Grav » Version: 1.4.7
    cpe:2.3:a:getgrav:grav:1.4.7
  • Getgrav » Grav » Version: 1.4.8
    cpe:2.3:a:getgrav:grav:1.4.8
  • Getgrav » Grav » Version: 1.5.0
    cpe:2.3:a:getgrav:grav:1.5.0
  • Getgrav » Grav » Version: 1.5.1
    cpe:2.3:a:getgrav:grav:1.5.1
  • Getgrav » Grav » Version: 1.5.10
    cpe:2.3:a:getgrav:grav:1.5.10
  • Getgrav » Grav » Version: 1.5.2
    cpe:2.3:a:getgrav:grav:1.5.2
  • Getgrav » Grav » Version: 1.5.3
    cpe:2.3:a:getgrav:grav:1.5.3
  • Getgrav » Grav » Version: 1.5.4
    cpe:2.3:a:getgrav:grav:1.5.4
  • Getgrav » Grav » Version: 1.5.5
    cpe:2.3:a:getgrav:grav:1.5.5
  • Getgrav » Grav » Version: 1.5.6
    cpe:2.3:a:getgrav:grav:1.5.6
  • Getgrav » Grav » Version: 1.5.7
    cpe:2.3:a:getgrav:grav:1.5.7
  • Getgrav » Grav » Version: 1.5.8
    cpe:2.3:a:getgrav:grav:1.5.8
  • Getgrav » Grav » Version: 1.5.9
    cpe:2.3:a:getgrav:grav:1.5.9
  • Getgrav » Grav » Version: 1.6.0
    cpe:2.3:a:getgrav:grav:1.6.0
  • Getgrav » Grav » Version: 1.6.1
    cpe:2.3:a:getgrav:grav:1.6.1
  • Getgrav » Grav » Version: 1.6.10
    cpe:2.3:a:getgrav:grav:1.6.10
  • Getgrav » Grav » Version: 1.6.11
    cpe:2.3:a:getgrav:grav:1.6.11
  • Getgrav » Grav » Version: 1.6.12
    cpe:2.3:a:getgrav:grav:1.6.12
  • Getgrav » Grav » Version: 1.6.13
    cpe:2.3:a:getgrav:grav:1.6.13
  • Getgrav » Grav » Version: 1.6.14
    cpe:2.3:a:getgrav:grav:1.6.14
  • Getgrav » Grav » Version: 1.6.15
    cpe:2.3:a:getgrav:grav:1.6.15
  • Getgrav » Grav » Version: 1.6.16
    cpe:2.3:a:getgrav:grav:1.6.16
  • Getgrav » Grav » Version: 1.6.17
    cpe:2.3:a:getgrav:grav:1.6.17
  • Getgrav » Grav » Version: 1.6.18
    cpe:2.3:a:getgrav:grav:1.6.18
  • Getgrav » Grav » Version: 1.6.19
    cpe:2.3:a:getgrav:grav:1.6.19
  • Getgrav » Grav » Version: 1.6.2
    cpe:2.3:a:getgrav:grav:1.6.2
  • Getgrav » Grav » Version: 1.6.20
    cpe:2.3:a:getgrav:grav:1.6.20
  • Getgrav » Grav » Version: 1.6.21
    cpe:2.3:a:getgrav:grav:1.6.21
  • Getgrav » Grav » Version: 1.6.22
    cpe:2.3:a:getgrav:grav:1.6.22
  • Getgrav » Grav » Version: 1.6.23
    cpe:2.3:a:getgrav:grav:1.6.23
  • Getgrav » Grav » Version: 1.6.24
    cpe:2.3:a:getgrav:grav:1.6.24
  • Getgrav » Grav » Version: 1.6.25
    cpe:2.3:a:getgrav:grav:1.6.25
  • Getgrav » Grav » Version: 1.6.26
    cpe:2.3:a:getgrav:grav:1.6.26
  • Getgrav » Grav » Version: 1.6.27
    cpe:2.3:a:getgrav:grav:1.6.27
  • Getgrav » Grav » Version: 1.6.28
    cpe:2.3:a:getgrav:grav:1.6.28
  • Getgrav » Grav » Version: 1.6.29
    cpe:2.3:a:getgrav:grav:1.6.29
  • Getgrav » Grav » Version: 1.6.3
    cpe:2.3:a:getgrav:grav:1.6.3
  • Getgrav » Grav » Version: 1.6.30
    cpe:2.3:a:getgrav:grav:1.6.30
  • Getgrav » Grav » Version: 1.6.31
    cpe:2.3:a:getgrav:grav:1.6.31
  • Getgrav » Grav » Version: 1.6.4
    cpe:2.3:a:getgrav:grav:1.6.4
  • Getgrav » Grav » Version: 1.6.5
    cpe:2.3:a:getgrav:grav:1.6.5
  • Getgrav » Grav » Version: 1.6.6
    cpe:2.3:a:getgrav:grav:1.6.6
  • Getgrav » Grav » Version: 1.6.7
    cpe:2.3:a:getgrav:grav:1.6.7
  • Getgrav » Grav » Version: 1.6.8
    cpe:2.3:a:getgrav:grav:1.6.8
  • Getgrav » Grav » Version: 1.6.9
    cpe:2.3:a:getgrav:grav:1.6.9
  • Getgrav » Grav » Version: 1.7.0
    cpe:2.3:a:getgrav:grav:1.7.0
  • Getgrav » Grav » Version: 1.7.1
    cpe:2.3:a:getgrav:grav:1.7.1
  • Getgrav » Grav » Version: 1.7.10
    cpe:2.3:a:getgrav:grav:1.7.10
  • Getgrav » Grav » Version: 1.7.11
    cpe:2.3:a:getgrav:grav:1.7.11
  • Getgrav » Grav » Version: 1.7.12
    cpe:2.3:a:getgrav:grav:1.7.12
  • Getgrav » Grav » Version: 1.7.13
    cpe:2.3:a:getgrav:grav:1.7.13
  • Getgrav » Grav » Version: 1.7.14
    cpe:2.3:a:getgrav:grav:1.7.14
  • Getgrav » Grav » Version: 1.7.15
    cpe:2.3:a:getgrav:grav:1.7.15
  • Getgrav » Grav » Version: 1.7.16
    cpe:2.3:a:getgrav:grav:1.7.16
  • Getgrav » Grav » Version: 1.7.17
    cpe:2.3:a:getgrav:grav:1.7.17
  • Getgrav » Grav » Version: 1.7.18
    cpe:2.3:a:getgrav:grav:1.7.18
  • Getgrav » Grav » Version: 1.7.19
    cpe:2.3:a:getgrav:grav:1.7.19
  • Getgrav » Grav » Version: 1.7.20
    cpe:2.3:a:getgrav:grav:1.7.20
  • Getgrav » Grav » Version: 1.7.21
    cpe:2.3:a:getgrav:grav:1.7.21
  • Getgrav » Grav » Version: 1.7.22
    cpe:2.3:a:getgrav:grav:1.7.22
  • Getgrav » Grav » Version: 1.7.23
    cpe:2.3:a:getgrav:grav:1.7.23
  • Getgrav » Grav » Version: 1.7.24
    cpe:2.3:a:getgrav:grav:1.7.24
  • Getgrav » Grav » Version: 1.7.25
    cpe:2.3:a:getgrav:grav:1.7.25
  • Getgrav » Grav » Version: 1.7.26
    cpe:2.3:a:getgrav:grav:1.7.26
  • Getgrav » Grav » Version: 1.7.26.1
    cpe:2.3:a:getgrav:grav:1.7.26.1
  • Getgrav » Grav » Version: 1.7.27
    cpe:2.3:a:getgrav:grav:1.7.27
  • Getgrav » Grav » Version: 1.7.27.1
    cpe:2.3:a:getgrav:grav:1.7.27.1
  • Getgrav » Grav » Version: 1.7.28
    cpe:2.3:a:getgrav:grav:1.7.28
  • Getgrav » Grav » Version: 1.7.29
    cpe:2.3:a:getgrav:grav:1.7.29
  • Getgrav » Grav » Version: 1.7.29.1
    cpe:2.3:a:getgrav:grav:1.7.29.1
  • Getgrav » Grav » Version: 1.7.3
    cpe:2.3:a:getgrav:grav:1.7.3
  • Getgrav » Grav » Version: 1.7.30
    cpe:2.3:a:getgrav:grav:1.7.30
  • Getgrav » Grav » Version: 1.7.31
    cpe:2.3:a:getgrav:grav:1.7.31
  • Getgrav » Grav » Version: 1.7.32
    cpe:2.3:a:getgrav:grav:1.7.32
  • Getgrav » Grav » Version: 1.7.33
    cpe:2.3:a:getgrav:grav:1.7.33
  • Getgrav » Grav » Version: 1.7.34
    cpe:2.3:a:getgrav:grav:1.7.34
  • Getgrav » Grav » Version: 1.7.35
    cpe:2.3:a:getgrav:grav:1.7.35
  • Getgrav » Grav » Version: 1.7.36
    cpe:2.3:a:getgrav:grav:1.7.36
  • Getgrav » Grav » Version: 1.7.37
    cpe:2.3:a:getgrav:grav:1.7.37
  • Getgrav » Grav » Version: 1.7.37.1
    cpe:2.3:a:getgrav:grav:1.7.37.1
  • Getgrav » Grav » Version: 1.7.38
    cpe:2.3:a:getgrav:grav:1.7.38
  • Getgrav » Grav » Version: 1.7.39
    cpe:2.3:a:getgrav:grav:1.7.39
  • Getgrav » Grav » Version: 1.7.39.1
    cpe:2.3:a:getgrav:grav:1.7.39.1
  • Getgrav » Grav » Version: 1.7.39.2
    cpe:2.3:a:getgrav:grav:1.7.39.2
  • Getgrav » Grav » Version: 1.7.39.3
    cpe:2.3:a:getgrav:grav:1.7.39.3
  • Getgrav » Grav » Version: 1.7.39.4
    cpe:2.3:a:getgrav:grav:1.7.39.4
  • Getgrav » Grav » Version: 1.7.4
    cpe:2.3:a:getgrav:grav:1.7.4
  • Getgrav » Grav » Version: 1.7.40
    cpe:2.3:a:getgrav:grav:1.7.40
  • Getgrav » Grav » Version: 1.7.41
    cpe:2.3:a:getgrav:grav:1.7.41
  • Getgrav » Grav » Version: 1.7.41.1
    cpe:2.3:a:getgrav:grav:1.7.41.1
  • Getgrav » Grav » Version: 1.7.41.2
    cpe:2.3:a:getgrav:grav:1.7.41.2
  • Getgrav » Grav » Version: 1.7.5
    cpe:2.3:a:getgrav:grav:1.7.5
  • Getgrav » Grav » Version: 1.7.6
    cpe:2.3:a:getgrav:grav:1.7.6
  • Getgrav » Grav » Version: 1.7.7
    cpe:2.3:a:getgrav:grav:1.7.7
  • Getgrav » Grav » Version: 1.7.8
    cpe:2.3:a:getgrav:grav:1.7.8
  • Getgrav » Grav » Version: 1.7.9
    cpe:2.3:a:getgrav:grav:1.7.9


Products
Pricing
Contact Us

Shodan ® - All rights reserved