CVE-2025-64752

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-64752", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-11-10T22:29:34.873Z", "datePublished": "2025-11-13T21:43:57.610Z", "dateUpdated": "2025-11-14T17:10:33.307Z"}, "containers": {"cna": {"title": "grist-core has path to server-side requests via websocket", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/gristlabs/grist-core/security/advisories/GHSA-qh95-2qv8-pqx3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/gristlabs/grist-core/security/advisories/GHSA-qh95-2qv8-pqx3"}, {"name": "https://github.com/gristlabs/grist-core/releases/tag/v1.7.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/gristlabs/grist-core/releases/tag/v1.7.7"}], "affected": [{"vendor": "gristlabs", "product": "grist-core", "versions": [{"version": "< 1.7.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-11-13T21:43:57.610Z"}, "descriptions": [{"lang": "en", "value": "grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with access to any document on a Grist installation can use a feature for fetching from a URL that is executed on the server. The privileged network access of server-side requests could offer opportunities for attack escalation. This issue is fixed in version 1.7.7. The mitigation was to use the proxy for untrusted fetches intended for such purposes. As a workaround, avoid making http/https endpoints available to an instance running Grist that expose credentials or operate without credentials."}], "source": {"advisory": "GHSA-qh95-2qv8-pqx3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-14T16:25:04.348078Z", "id": "CVE-2025-64752", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-14T17:10:33.307Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-64752", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-14T16:25:04.348078Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-14T17:06:57.857Z"}}], "cna": {"title": "grist-core has path to server-side requests via websocket", "source": {"advisory": "GHSA-qh95-2qv8-pqx3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "gristlabs", "product": "grist-core", "versions": [{"status": "affected", "version": "< 1.7.7"}]}], "references": [{"url": "https://github.com/gristlabs/grist-core/security/advisories/GHSA-qh95-2qv8-pqx3", "name": "https://github.com/gristlabs/grist-core/security/advisories/GHSA-qh95-2qv8-pqx3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/gristlabs/grist-core/releases/tag/v1.7.7", "name": "https://github.com/gristlabs/grist-core/releases/tag/v1.7.7", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with access to any document on a Grist installation can use a feature for fetching from a URL that is executed on the server. The privileged network access of server-side requests could offer opportunities for attack escalation. This issue is fixed in version 1.7.7. The mitigation was to use the proxy for untrusted fetches intended for such purposes. As a workaround, avoid making http/https endpoints available to an instance running Grist that expose credentials or operate without credentials."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-11-13T21:43:57.610Z"}}}, "cveMetadata": {"cveId": "CVE-2025-64752", "state": "PUBLISHED", "dateUpdated": "2025-11-14T17:10:33.307Z", "dateReserved": "2025-11-10T22:29:34.873Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-11-13T21:43:57.610Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "grist-core", "vendor": "gristlabs", "versions": [{"status": "affected", "version": "< 1.7.7"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:getgrist:grist-core:*:*:*:*:*:*:*:*", "matchCriteriaId": "B4BAA1F5-E447-47A3-9824-ECA85B6B42B2", "versionEndExcluding": "1.7.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with access to any document on a Grist installation can use a feature for fetching from a URL that is executed on the server. The privileged network access of server-side requests could offer opportunities for attack escalation. This issue is fixed in version 1.7.7. The mitigation was to use the proxy for untrusted fetches intended for such purposes. As a workaround, avoid making http/https endpoints available to an instance running Grist that expose credentials or operate without credentials."}, {"lang": "es", "value": "grist-core es un servidor de alojamiento de hojas de c\u00e1lculo. Versiones anteriores a la versi\u00f3n 1.7.7, un usuario con acceso a cualquier documento en una instalaci\u00f3n de Grist puede usar una funci\u00f3n para recuperar contenido desde una URL que se ejecuta en el servidor. El acceso privilegiado a la red de las solicitudes del lado del servidor podr\u00eda ofrecer oportunidades para la escalada de ataques. Este problema se ha corregido en la versi\u00f3n 1.7.7. La mitigaci\u00f3n fue usar el proxy para las recuperaciones no confiables destinadas a tales fines. Como soluci\u00f3n alternativa, evite que los endpoints HTTP/HTTPS est\u00e9n disponibles para una instancia que ejecuta Grist que expongan credenciales u operen sin credenciales."}], "id": "CVE-2025-64752", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64752", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-14T16:25:04.348078Z", "version": "2.0.3"}}]}, "published": "2025-11-13T22:15:52.563", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/gristlabs/grist-core/releases/tag/v1.7.7"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/gristlabs/grist-core/security/advisories/GHSA-qh95-2qv8-pqx3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-11-14T09:27:39.684523+00:00", "updated": "2025-11-14T09:27:39.684549+00:00", "vendors": ["getgrist", "getgrist$PRODUCT$grist-core"]}