Description
Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions delete, approve, and approveAll. Authenticated Admin users lacking the admin.guestbook permission, or external sites abusing a moderator's session via nonce-less GET requests, can delete or approve Guestbook entries.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| getgrav | grav-plugin-guestbook | 0.5.0 – < 0.5.2 | 0.5.2 |
References
- GitHub Security Advisory (GHSA-wxr7-h5mm-c7mv) vendor-advisory third-party-advisory
- VulnCheck Advisory: Grav Guestbook Plugin 0.5.0 and 0.5.1 Missing Authorization and CSRF in Moderation third-party-advisory