CyberRota Analysis
AI-GeneratedGrav API Plugin versions prior to 1.0.10 are vulnerable due to insufficient access controls, allowing authenticated users with the api.config.write privilege to alter critical security settings. This flaw can lead to the disabling of rate limiting, facilitating credential brute-forcing attacks, and the reconfiguration of CORS policies to permit malicious origins. Organizations using this plugin should prioritize remediation to safeguard against potential exploitation by attackers.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege to modify rate limiting and CORS settings. Attackers can disable rate limiting site-wide to enable credential brute-forcing attacks and reconfigure CORS policies to include attacker-controlled origins with credentials enabled.