CVE-2025-66304

Katalog CVE

CVSS 7.2 · High EPSS 0,41%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada getgrav grav. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, users with read access on the user account management section of the admin panel can view the password hashes of all users, including the admin user. This exposure can potentially lead to privilege escalation if an attacker can crack these password hashes. This vulnerability is fixed in 1.8.0-beta.27.

Rincian

Terbit di NVD

1 Desember 2025

Terakhir diubah

26 September 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-201: Insertion of Sensitive Information Into Sent Data

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/getgrav/grav/security/advisories/GHSA-gq3g-666w-7h85 exploit · advisory vendor
• https://github.com/getgrav/grav/commit/9d11094e4133f059688fad1e00dbe96fb6e3ead7 patch