PT-2019-12903 · Pivotal · Grails

Published 2019-06-04 · Updated 2022-05-24 · CVE-2019-12728

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AC:H/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions Grails versions prior to 3.3.10

Description The issue concerns the use of cleartext HTTP to resolve the SDKMan notification service. It is noted that users' apps were not resolving dependencies over cleartext HTTP.

Recommendations For versions prior to 3.3.10, update to version 3.3.10 or later to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-669

CWE-494

Related Identifiers

CVE-2019-12728

GHSA-PMXF-4V8C-RWR7

Affected Products

Grails

References · 5

• 🔥 https://github.com/grails/grails-core/issues/11250 · Exploit
• https://osv.dev/vulnerability/CVE-2019-12728 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12728 · Security Note
• https://osv.dev/vulnerability/GHSA-pmxf-4v8c-rwr7 · Vendor Advisory
• https://objectcomputing.com/news/2019/05/30/possible-grails-mitm-vulnerability · Note