CVE-2024-55075 — Grocy project / Grocy

CVE-2024-55075

Grocy project / Grocy PUBLISHED

Description (CNA)

Grocy through 4.3.0 allows remote attackers to obtain sensitive information via direct requests to pages that are not shown in the UI, such as calendar and recipes.

Affected (CNA)

Vendor / product	Versions
Grocy project / Grocy	affected 0 through 4.3.0

CWE

CWE-425

References

https://m10x.de/posts/2024/11/all-your-recipe-are-belong-to-us-part-1/3-stored-xss-csrf-and-broken-access-control-vulnerabilities-in-grocy/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.