CVE-2025-13084: medium-severity vulnerability in Opto 22 groov View Server
Opto 22 groov View Exposure of Sensitive Information Through Metadata
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The groov View API exposes users' API keys through a public endpoint that requires only Editor-level access. An attacker with Editor permissions can retrieve secret API keys for all users, including administrators, compromising account security.
The /users endpoint in groov View API returns sensitive metadata including plaintext or insufficiently protected API keys for all users regardless of role hierarchy. An authenticated attacker with Editor privileges can enumerate and extract API credentials for administrative accounts, leading to unauthorized access and privilege escalation.