CVE-2025-64752

Katalog CVE

CVSS 6.5 · Medium EPSS 0,23%

Kerentanan Server-Side Request Forgery (SSRF) pada getgrist grist-core. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with access to any document on a Grist installation can use a feature for fetching from a URL that is executed on the server. The privileged network access of server-side requests could offer opportunities for attack escalation. This issue is fixed in version 1.7.7. The mitigation was to use the proxy for untrusted fetches intended for such purposes. As a workaround, avoid making http/https endpoints available to an instance running Grist that expose credentials or operate without credentials.

Rincian

Terbit di NVD

13 November 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,23% peluang dieksploitasi; lebih tinggi dari 12,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/gristlabs/grist-core/security/advisories/GHSA-qh95-2qv8-pqx3 advisory vendor
• https://github.com/gristlabs/grist-core/releases/tag/v1.7.7 release notes