1 result · Clear filters · Feed
-
High 7.2
Plugins can be installed with minimal admin privileges
The Grav admin plugin prior to version 1.10.11 does not correctly verify caller's privileges. As a consequence, users with the permission `admin.login` can install third-party plugins and their dependencies. By installing the right plugin, an attacker can obt…