VulnerabilityAnalyzed

CVE-2024-55075

Grocy through 4.3.0 allows remote attackers to obtain sensitive information via direct requests to pages that are not shown in the UI, such as calendar and recipes.

MEDIUM 5.3EPSS 0.52%

Does this matter?

Lower severity and a low EPSS score (0.52%). Track it; it rarely justifies an emergency change on its own.

Description

Grocy through 4.3.0 allows remote attackers to obtain sensitive information via direct requests to pages that are not shown in the UI, such as calendar and recipes.

CVSS 3.1: 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS: 0.52% probability · 42th percentile
CISA KEV: Not listed
Weakness: CWE-425
Affected: grocy project/grocy
Source: cve@mitre.org

References

https://m10x.de/posts/2024/11/all-your-recipe-are-belong-to-us-part-1/3-stored-xss-csrf-and-broken-access-control-vulnerabilities-in-grocy/Exploit, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.