high8.1
CVE-2024-55076
Grocy through 4.3.0 has no CSRF protection, as demonstrated by changing the Administrator's password.
Impact
Grocy through 4.3.0 has no CSRF protection, as demonstrated by changing the Administrator's password.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Grocy Project | Grocy | through 4.3.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://m10x.de/posts/2024/11/all-your-recipe-are-belong-to-us-part-1/3-stored-xss-csrf-and-broken-access-control-vulnerabilities-in-grocy/
- https://m10x.de/posts/2024/11/all-your-recipe-are-belong-to-us-part-1/3-stored-xss-csrf-and-broken-access-control-vulnerabilities-in-grocy/