Vulnerability · Published Jul 19, 2022 · Assigned by mitre
CVE-2022-35912
Critical 9.8
In plain English
A critical-severity security flaw in the org.grails:grails-databinding package (Maven). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 84% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)2.3%top 16.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In grails-databinding in Grails before 3.3.15, 4.x before 4.1.1, 5.x before 5.1.9, and 5.2.x before 5.2.1 (at least when certain Java 8 configurations are used), data binding allows a remote attacker to execute code by gaining access to the class loader.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.grails:grails-databinding | 3.3.15 | GHSA-6rh6-x8ww-9h97 |
| Maven | org.grails:grails-databinding | 4.1.1 | GHSA-6rh6-x8ww-9h97 |
| Maven | org.grails:grails-databinding | 5.1.9 | GHSA-6rh6-x8ww-9h97 |
| Maven | org.grails:grails-databinding | 5.2.1 | GHSA-6rh6-x8ww-9h97 |
Affected products (as reported)
References
- https://github.com/grails/grails-core/security/advisories/GHSA-6rh6-x8ww-9h97 x_refsource_CONFIRM
- https://grails.org/blog/2022-07-18-rce-vulnerability.html x_refsource_CONFIRM
- https://github.com/grails/grails-core/issues/12626 x_refsource_CONFIRM
- [oss-security] 20220720 Grails Framework Remote Code Execution Vulnerability, CVE-2022-35912 mailing-list, x_refsource_MLIST