PatchTheCVEgrocy vulnerabilities and fixes
Recent CVEs affecting grocy, with upgrade or downgrade steps. 4 tracked.
grocy has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2025-01-06. Highest priority: CVE-2024-55074 (score 49/100).
- CVE-2024-8370 LOW 3.5 UPGRADE A vulnerability classified as problematic was found in Grocy up to 4.2.0
- CVE-2024-55076 HIGH 8.1 UPGRADE Grocy through 4.3.0 has no CSRF protection, as demonstrated by changing the Administrator's password.
- CVE-2024-55075 MEDIUM 4.3 UPGRADE Grocy through 4.3.0 allows remote attackers to obtain sensitive information via direct requests to pages that
- CVE-2024-55074 HIGH 8.8 UPGRADE The edit profile function of Grocy through 4.3.0 allows stored XSS and resultant privilege escalation by uploa
FAQ
How do I fix grocy vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is grocy being exploited right now?
None of the tracked grocy CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which grocy CVE should I patch first?
CVE-2024-55074 currently ranks highest (49/100): The edit profile function of Grocy through 4.3.0 allows stored XSS and resultant privilege escalation by uploa.