A vulnerability in the Grav web platform permits unauthorized access to sensitive information, potentially leading to data leakage.

This vulnerability (CWE-200) involves the exposure of sensitive information to an unauthorized actor. The attack vector is network-based and requires the attacker to have low-level privileges to successfully gain unauthorized access to sensitive data.

With a CVSS score of 7.7, this vulnerability represents a significant risk to data confidentiality. Unauthorized access to sensitive information can result in the compromise of proprietary configuration data, user information, or administrative credentials, potentially leading to further escalation of privileges or broader system compromise.

Immediate Action: Update Grav to version 2.0.0-rc.2 or later to resolve the information exposure flaw.

Proactive Monitoring: Review application access logs for unusual patterns of data retrieval or unauthorized access requests to sensitive directories.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter suspicious requests and limit exposure to sensitive endpoints until the platform can be patched.

Public Exploit Available: No (Exploit available: unknown)

The existence of a proof-of-concept elevates the urgency of this vulnerability. Administrators should treat this as a high-priority update to ensure that sensitive information is properly protected and that unauthorized actors cannot exploit the current information disclosure flaw.