Medium severity5.3NVD Advisory· Published Nov 10, 2017· Updated Jun 17, 2026

CVE-2017-16754

Description

Bolt before 3.3.6 does not properly restrict access to _profiler routes, related to EventListener/ProfilerListener.php and Provider/EventListenerServiceProvider.php.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
bolt/boltPackagist	< 3.3.6	3.3.6

Affected products

Boltcms/Bolt
cpe:2.3:a:boltcms:bolt:*:*:*:*:*:*:*:*
Range: <=3.3.5
ghsa-coords
pkg:composer/bolt/bolt
Range: < 3.3.6

Patches

Vulnerability mechanics

References

github.com/bolt/bolt/commit/aa21787241945457a2e4abc8b079672935fe0840nvdPatchThird Party AdvisoryWEB
www.securityfocus.com/bid/101777nvdThird Party AdvisoryVDB EntryWEB
github.com/advisories/GHSA-wr23-m9m2-jjf4ghsaADVISORY
github.com/bolt/bolt/releases/tag/v3.3.6nvdRelease NotesThird Party AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2017-16754ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000