CVE-2026-117604
CVE-2026-117604 · Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized() that allows unauthenticated visitors to read /__clockwork/ profiler data via a loopback REMOTE_ADDR fallback. Behind a same-host reverse proxy, remote requests appear as loopback, letting attackers read stored records including administrator plaintext passwords and configuration credentials.
CVSS 8.7 · Alta · EPSS 0,3% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
grav
- Versiones
- ≥ 1.7.53.3, < 1.7.53.6: Afectada (custom)
- 1.7.53.6: No afectada (custom)
Actualiza a 1.7.53.6
Fuentes originales
- https://github.com/getgrav/grav/security/advisories/GHSA-xprx-c7jf-cp6g
- https://github.com/getgrav/grav/commit/4d9fca043f990a818d65cea61c928203b9e19641
- https://github.com/getgrav/grav/releases/tag/1.7.53.6
- https://www.vulncheck.com/advisories/grav-from-1.7.53.3-before-1.7.53.6-clockwork-profiler-authorization-bypass-via-loopback-fallback
- https://nvd.nist.gov/vuln/detail/CVE-2026-117604