PT-2019-12903 · Pivotal · Grails

Publicado 2019-06-04 · Atualizado 2022-05-24 · CVE-2019-12728

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AC:H/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions Grails versions prior to 3.3.10

Description The issue concerns the use of cleartext HTTP to resolve the SDKMan notification service. It is noted that users' apps were not resolving dependencies over cleartext HTTP.

Recommendations For versions prior to 3.3.10, update to version 3.3.10 or later to resolve the issue.

Exploit

Correção

Enumeração de Fraquezas

CWE-669

CWE-494

Identificadores relacionados

CVE-2019-12728

GHSA-PMXF-4V8C-RWR7

Produtos afetados

Grails

Referências · 5

• 🔥 https://github.com/grails/grails-core/issues/11250 · Exploit
• https://osv.dev/vulnerability/CVE-2019-12728 · Aviso do Fabricante
• https://objectcomputing.com/news/2019/05/30/possible-grails-mitm-vulnerability · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-12728 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-pmxf-4v8c-rwr7 · Aviso do Fabricante