Stored Cross Site Scripting in Grails Fields Plugin

中危 6.1CVE-2018-1000529 · GHSA-q25j-gcmv-5qpp · Published 26/06/2018 · updated 17/06/2026

要点

CVE-2018-1000529 是影响 org.grails.plugins:fields, org.grails:grails-core, grails fields (grails) 的中危 (CVSS 6.1)漏洞。
未来 30 天内被利用的概率（EPSS）：1.1%，高于 66.7% 的漏洞。
修复：升级到 2.2.8, 3.3.6 或更高版本。

Package	Affected versions	Patched versions
org.grails.plugins:fields Maven	`< 2.2.8`	`2.2.8`
org.grails:grails-core Maven	`< 3.3.6`	`3.3.6`
grails fields grails	`= 2.2.7`	No fix yet

Description

Grails Fields plugin version 2.2.7 contains a Cross Site Scripting (XSS) vulnerability in using the display tag that can result in XSS. This vulnerability has been fixed in version 2.2.8.

NVD description

Grails Fields plugin version 2.2.7 contains a Cross Site Scripting (XSS) vulnerability in Using the display tag that can result in XSS . This vulnerability appears to have been fixed in 2.2.8.

References

nvd.nist.gov/vuln/detail/CVE-2018-1000529 · ADVISORY
grails-fields-plugin/grails-fields · WEB
GitHub Advisory GHSA-q25j-gcmv-5qpp · ADVISORY
grails-fields-plugin/grails-fields · PACKAGE
martinfrancois/CVE-2018-1000529 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free