PT-2022-23018 · Grails · Grails

Codeplutos + 1 · Published 2022-07-19 · Updated 2022-07-28 · CVE-2022-35912

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Grails versions prior to 3.3.15 Grails versions 4.x prior to 4.1.1 Grails versions 5.x prior to 5.1.9 Grails versions 5.2.x prior to 5.2.1

Description A vulnerability has been discovered in the Grails data-binding logic which allows for Remote Code Execution in a Grails application. This exploit requires the application to be running on Java 8, either deployed as a WAR to a servlet container, or an executable JAR. A remote attacker can execute code by gaining access to the class loader.

Recommendations For Grails versions prior to 3.3.15, update to version 3.3.15 or later. For Grails versions 4.x prior to 4.1.1, update to version 4.1.1 or later. For Grails versions 5.x prior to 5.1.9, update to version 5.1.9 or later. For Grails versions 5.2.x prior to 5.2.1, update to version 5.2.1 or later.

Fix

Related Identifiers

CVE-2022-35912

GHSA-6RH6-X8WW-9H97

Affected Products

Grails

References · 10

• https://github.com/grails/grails-core/issues/12626 · Patch
• https://osv.dev/vulnerability/CVE-2022-35912 · Vendor Advisory
• https://grails.org/blog/2022-07-18-rce-vulnerability.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35912 · Security Note
• https://osv.dev/vulnerability/GHSA-6rh6-x8ww-9h97 · Vendor Advisory
• https://github.com/grails/grails-core/security/advisories/GHSA-6rh6-x8ww-9h97 · Note
• https://github.com/grails/grails-core · Note
• https://t.me/cvenotify/33874 · Telegram Post
• http://openwall.com/lists/oss-security/2022/07/20/4 · Note
• https://t.me/cibsecurity/46568 · Telegram Post