{"id":"CVE-2020-29553","details":"The Scheduler in Grav CMS through 1.7.0-rc.17 allows an attacker to execute a system command by tricking an admin into visiting a malicious website (CSRF).","aliases":["GHSA-fqff-vcvx-68h3"],"modified":"2026-08-07T11:30:59.454489705Z","published":"2021-03-15T19:15:13.243Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"1.7.0-beta1"},{"last_affected":"1.7.0-beta1"},{"introduced":"1.7.0-beta10"},{"last_affected":"1.7.0-beta10"},{"introduced":"1.7.0-beta2"},{"last_affected":"1.7.0-beta2"},{"introduced":"1.7.0-beta3"},{"last_affected":"1.7.0-beta3"},{"introduced":"1.7.0-beta4"},{"last_affected":"1.7.0-beta4"},{"introduced":"1.7.0-beta5"},{"last_affected":"1.7.0-beta5"},{"introduced":"1.7.0-beta6"},{"last_affected":"1.7.0-beta6"},{"introduced":"1.7.0-beta7"},{"last_affected":"1.7.0-beta7"},{"introduced":"1.7.0-beta8"},{"last_affected":"1.7.0-beta8"},{"introduced":"1.7.0-beta9"},{"last_affected":"1.7.0-beta9"},{"introduced":"1.7.0-rc1"},{"last_affected":"1.7.0-rc1"},{"introduced":"1.7.0-rc10"},{"last_affected":"1.7.0-rc10"},{"introduced":"1.7.0-rc11"},{"last_affected":"1.7.0-rc11"},{"introduced":"1.7.0-rc12"},{"last_affected":"1.7.0-rc12"},{"introduced":"1.7.0-rc13"},{"last_affected":"1.7.0-rc13"},{"introduced":"1.7.0-rc14"},{"last_affected":"1.7.0-rc14"},{"introduced":"1.7.0-rc15"},{"last_affected":"1.7.0-rc15"},{"introduced":"1.7.0-rc16"},{"last_affected":"1.7.0-rc16"},{"introduced":"1.7.0-rc17"},{"last_affected":"1.7.0-rc17"},{"introduced":"1.7.0-rc2"},{"last_affected":"1.7.0-rc2"},{"introduced":"1.7.0-rc3"},{"last_affected":"1.7.0-rc3"},{"introduced":"1.7.0-rc4"},{"last_affected":"1.7.0-rc4"},{"introduced":"1.7.0-rc5"},{"last_affected":"1.7.0-rc5"},{"introduced":"1.7.0-rc6"},{"last_affected":"1.7.0-rc6"},{"introduced":"1.7.0-rc7"},{"last_affected":"1.7.0-rc7"},{"introduced":"1.7.0-rc8"},{"last_affected":"1.7.0-rc8"},{"introduced":"1.7.0-rc9"},{"last_affected":"1.7.0-rc9"}],"source":"CPE_STRING","vendor_product":"getgrav:grav_cms","cpes":["cpe:2.3:a:getgrav:grav_cms:1.7.0:beta10:*:*:*:*:*:*","cpe:2.3:a:getgrav:grav_cms:1.7.0:beta1:*:*:*:*:*:*","cpe:2.3:a:getgrav:grav_cms:1.7.0:beta2:*:*:*:*:*:*","cpe:2.3:a:getgrav:grav_cms:1.7.0:beta3:*:*:*:*:*:*","cpe:2.3:a:getgrav:grav_cms:1.7.0:beta4:*:*:*:*:*:*","cpe:2.3:a:getgrav:grav_cms:1.7.0:beta5:*:*:*:*:*:*","cpe:2.3:a:getgrav:grav_cms:1.7.0:beta6:*:*:*:*:*:*","cpe:2.3:a:getgrav:grav_cms:1.7.0:beta7:*:*:*:*:*:*","cpe:2.3:a:getgrav:grav_cms:1.7.0:beta8:*:*:*:*:*:*","cpe:2.3:a:getgrav:grav_cms:1.7.0:beta9:*:*:*:*:*:*","cpe:2.3:a:getgrav:grav_cms:1.7.0:rc10:*:*:*:*:*:*","cpe:2.3:a:getgrav:grav_cms:1.7.0:rc11:*:*:*:*:*:*","cpe:2.3:a:getgrav:grav_cms:1.7.0:rc12:*:*:*:*:*:*","cpe:2.3:a:getgrav:grav_cms:1.7.0:rc13:*:*:*:*:*:*","cpe:2.3:a:getgrav:grav_cms:1.7.0:rc14:*:*:*:*:*:*","cpe:2.3:a:getgrav:grav_cms:1.7.0:rc15:*:*:*:*:*:*","cpe:2.3:a:getgrav:grav_cms:1.7.0:rc16:*:*:*:*:*:*","cpe:2.3:a:getgrav:grav_cms:1.7.0:rc17:*:*:*:*:*:*","cpe:2.3:a:getgrav:grav_cms:1.7.0:rc1:*:*:*:*:*:*","cpe:2.3:a:getgrav:grav_cms:1.7.0:rc2:*:*:*:*:*:*","cpe:2.3:a:getgrav:grav_cms:1.7.0:rc3:*:*:*:*:*:*","cpe:2.3:a:getgrav:grav_cms:1.7.0:rc4:*:*:*:*:*:*","cpe:2.3:a:getgrav:grav_cms:1.7.0:rc5:*:*:*:*:*:*","cpe:2.3:a:getgrav:grav_cms:1.7.0:rc6:*:*:*:*:*:*","cpe:2.3:a:getgrav:grav_cms:1.7.0:rc7:*:*:*:*:*:*","cpe:2.3:a:getgrav:grav_cms:1.7.0:rc8:*:*:*:*:*:*","cpe:2.3:a:getgrav:grav_cms:1.7.0:rc9:*:*:*:*:*:*"]}]},"references":[{"type":"EVIDENCE","url":"https://blog.bssi.fr/cve-2020-29553-cve-2020-29555-cve-2020-29556-multiple-vulnerabilities-within-cms-grav/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/getgrav/grav","events":[{"introduced":"0"},{"last_affected":"d4a20c71c2dadf7c843a170975a8161b7f5ce191"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:getgrav:grav_cms:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"1.6.31"}]}}],"versions":["1.6.31","1.6.30","1.6.29","1.6.28","1.6.27","1.6.26","1.6.25","1.6.24","1.6.23","1.6.22","1.6.21","1.6.20","1.6.19","1.6.18","1.6.16","1.6.15","1.6.14","1.6.13","1.6.12","1.6.11","1.6.10","1.6.9","1.6.8","1.6.7","1.6.6","1.6.5","1.6.4","1.6.3","1.6.2","1.6.1","1.6.0","1.5.10","1.5.9","1.5.8","1.5.7","1.5.6","1.5.5","1.5.4","1.5.3","1.5.2","1.5.1","1.5.0","1.4.8","1.4.7","1.4.6","1.4.5","1.4.4","1.4.3","1.4.2","1.4.1","1.4.0","1.3.10","1.3.9","1.3.8","1.3.7","1.3.6","1.3.5","1.3.4","1.3.3","1.3.2","1.3.1","1.3.0","1.2.4","1.2.3","1.2.2","1.2.1","1.2.0","1.1.17","1.1.9-rc.3","1.1.9-rc.2","1.1.9-rc.1","1.1.0-rc.3","1.1.0-rc.2","1.1.0-rc.1","1.1.0-beta.5","1.1.0-beta.4","1.1.0-beta.3","1.1.0-beta.2","1.1.0-beta.1","0.9.19","0.9.18","0.9.17","0.9.16","0.9.15","0.9.14","0.9.13","0.9.12","0.9.11","0.9.10","0.9.9","0.9.8","0.9.7","0.9.6","0.9.5","0.9.4","0.9.3","0.9.2","0.9.0","0.8.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-29553.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}