| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| org.grails:grails-databinding | ≥ 3.3.10, < 3.3.15≥ 4.0.0, < 4.1.1≥ 5.0.0, < 5.1.9≥ 5.2.0, < 5.2.1 | 3.3.154.1.15.1.95.2.1 |
| grails | = 5.2.0≥ 3.3.10, < 3.3.15≥ 4.0.0, < 4.1.1≥ 5.0.0, < 5.1.9 | 3.3.154.1.15.1.9 |
A vulnerability has been discovered in the Grails data-binding logic which allows for Remote Code Execution in a Grails application. This exploit requires the application to be running on Java 8, either deployed as a WAR to a servlet container, or an executable JAR.
Grails framework versions 5.2.1, 5.1.9, 4.1.1, and 3.3.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35912 https://grails.org/blog/2022-07-18-rce-vulnerability.html
If you have any questions or comments about this advisory:
This vulnerability was discovered by meizjm3i and codeplutos of AntGroup FG Security Lab
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí