Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact A specially crafted web request can lead to a JVM crash or denial of service. Any Grails framework application using Grails data binding is vulnerable. Patches Patches are available for Grails 3 and later. Workarounds No workaround is possible except to avoid data binding to request data. References - Blog post - Discussion - Mitre CVD record
Recommended action: Upgrade to 6.1.0, 5.3.4, 4.1.3 or 3.3.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A vulnerability has been discovered in the Grails data-binding logic which allows for Remote Code Execution in a Grails application. This exploit requires the application to be running on Java 8, either deployed as a WAR to a servlet container, or an executable JAR. Patches Grails framework versions 5.2.1, 5.1.9, 4.1.1, and 3.3.15 References https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35912 https://grails.org/blog/2022-07-18-rce-vulnerability.html For more information If you have any questions or comments about this advisory: https://grails.org/blog/2022-07-18-rce-vulnerability.html https://github.com/grails/grails-core/issues/12626 Email us at info@grails.org Credit This vulnerability was discovered by meizjm3i and codeplutos of AntGroup FG Security Lab
Recommended action: Upgrade to 5.2.1, 5.1.9, 4.1.1 or 3.3.15 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.