PT-2025-3093 · Grocy · Grocy

Published 2025-01-06 · Updated 2025-01-06 · CVE-2024-55074

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Grocy versions prior to 4.3.0

Description The issue in the edit profile function of Grocy allows stored Cross Site Scripting (XSS) and resultant privilege escalation by uploading a crafted HTML or SVG file.

Recommendations For versions prior to 4.3.0, update to version 4.3.0 or later to resolve the issue. As a temporary workaround, consider disabling the edit profile function until a patch is available. Restrict access to uploading HTML or SVG files to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-55074

Affected Products

Grocy

References · 6

• 🔥 https://m10x.de/posts/2024/11/all-your-recipe-are-belong-to-us-part-1/3-stored-xss-csrf-and-broken-access-control-vulnerabilities-in-grocy · Exploit
• https://osv.dev/vulnerability/CVE-2024-55074 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-55074 · Security Note
• https://twitter.com/CVEnew/status/1876365492924940609 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1876385805544927671 · Twitter Post
• https://t.me/cvedetector/14405 · Telegram Post