Threats tagged 'ghsa-xgqw-2hp2-cf72'

A vulnerability in Grav versions from 1.7.53.3 up to but not including 1.7.53.6 allows unauthorized users to bypass authorization checks in the Debugger::isDebuggerRequestAuthorized() function. This flaw enables unauthenticated visitors to access /__clockwork/ profiler data by exploiting a fallback to loopback REMOTE_ADDR. When Grav is behind a same-host reverse proxy, remote requests can be treated as loopback, allowing attackers to read sensitive stored records such as administrator plaintext passwords and configuration credentials.