PT-2025-48563 · Grav · Grav

CVE-2025-66304 · Publicado 2025-12-01 · Atualizado 2025-12-02

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.8.0-beta.27

Description Grav is a file-based Web platform. Users with read access to the user account management section of the admin panel can view the password hashes of all users, including the admin user. This exposure could allow an attacker to gain elevated privileges if they are able to crack the password hashes.

Recommendations Update to version 1.8.0-beta.27 or later.

Exploit

Correção

LPE

Information Disclosure

Enumeração de Fraquezas

CWE-200

CWE-201

Identificadores relacionados

CVE-2025-66304

GHSA-GQ3G-666W-7H85

Produtos afetados

Grav

Referências · 7

• 🔥 https://github.com/getgrav/grav/security/advisories/GHSA-gq3g-666w-7h85 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66304.json · Exploit
• https://github.com/getgrav/grav/commit/9d11094e4133f059688fad1e00dbe96fb6e3ead7 · Correção
• https://t.me/CVEtracker/38595 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1995611523511685445 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-66304 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-66304 · Nota de Segurança