Search criteria
12 vulnerabilities found for grails by gopivotal
FKIE_CVE-2016-6521
Vulnerability from fkie_nvd - Published: 2017-01-23 21:59 - Updated: 2025-04-20 01:37
Severity ?
Summary
Cross-site request forgery (CSRF) vulnerability in Grails console (aka Grails Debug Console and Grails Web Console) 2.0.7, 1.5.10, and earlier allows remote attackers to hijack the authentication of users for requests that execute arbitrary Groovy code via unspecified vectors.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:gopivotal:grails:*:*:*:*:*:*:*:*",
"matchCriteriaId": "680CBD14-8425-48AE-8889-098CB766307A",
"versionEndIncluding": "1.5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "28BEE9DC-DC76-4200-AAE1-D37B939BE805",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in Grails console (aka Grails Debug Console and Grails Web Console) 2.0.7, 1.5.10, and earlier allows remote attackers to hijack the authentication of users for requests that execute arbitrary Groovy code via unspecified vectors."
},
{
"lang": "es",
"value": "Vulnerabilidad de CSRF en la consola de Grails (tambi\u00e9n conocida como Grails Debug Console y Grails Web Console) 2.0.7, 1.5.10 y versiones anteriores permite a atacantes remotos secuestrar la autenticaci\u00f3n de usuarios para solicitudes que ejecuten c\u00f3digo Groovy arbitrario a trav\u00e9s de vectores no especificados."
}
],
"id": "CVE-2016-6521",
"lastModified": "2025-04-20T01:37:25.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-01-23T21:59:02.080",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2016/08/02/11"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2016/08/02/2"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2016/08/03/9"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/92267"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/sheehan/grails-console/issues/54"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://github.com/sheehan/grails-console/issues/55"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2016/08/02/11"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2016/08/02/2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2016/08/03/9"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/92267"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/sheehan/grails-console/issues/54"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://github.com/sheehan/grails-console/issues/55"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2014-0053
Vulnerability from fkie_nvd - Published: 2014-04-15 23:55 - Updated: 2025-04-12 10:46
Severity ?
Summary
The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 before 2.3.6 does not properly restrict access to files in the WEB-INF directory, which allows remote attackers to obtain sensitive information via a direct request. NOTE: this identifier has been SPLIT due to different researchers and different vulnerability types. See CVE-2014-2857 for the META-INF variant and CVE-2014-2858 for the directory traversal.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "BB4F4992-DAD4-43E4-A2D0-A00D585A2D31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FEB18D96-BB77-4C80-9534-F78B95687CEA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3D8A6B18-29FE-4194-8EFC-5543E1A46BC4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4B1FC971-D192-43D1-BD86-19E99ADF5C87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "5A9BE413-E5A0-442F-B9B7-69F8EDD91FB8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "48203D48-8A45-4648-981A-F28BE13282B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "E280C52A-2F26-4D14-B1E0-8FA25181E856",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "04574C35-A00D-49CC-8C50-301C7FC643F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A11BBF2D-4489-4111-98A1-AA0B89A15DC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "07D5A44B-5748-4AE4-9C8F-1718011961D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "C5BDE522-11D1-45AF-B60F-7F4022D85714",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "9039FCCF-740D-4320-BA11-BF9BCD7809CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "979685AE-AFA1-47A0-BC5E-BC06EFCF02DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "9DD08D54-5FA6-4E2D-8264-1FE8907D756A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E2B5FC64-83CC-49D3-BFDD-494763AB1FEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EE1BBB9C-39B5-40CB-A12C-E33B7E35CB18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6581AEB4-7049-4D84-9FB2-F5B58096BC60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "23CF1A57-C941-4198-8F18-5618D8C07DD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "44DAA96C-1916-4100-8936-4353A3DC26A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "29342858-3173-45A5-91BF-81689593C960",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FAF7A322-5AE4-450C-B939-4D6B448766D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4ACEC5A6-FE19-423E-BF40-B5574C648A99",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "38C46B0E-3D30-4D22-9DF4-161FA5DE773D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "828398A1-EF0C-4193-8D85-A91475162BFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "5AEC8808-6358-4D4F-8984-8D2A341D67E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7391B773-22CC-43D1-9848-F1DA14537049",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "446CEA94-E3B0-45A8-B491-EF7F1EA4D74D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1F330DB8-2576-44F1-A10C-7E3985FDFF9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "B6BF47B6-6338-4A4B-B7B2-BB83F5D2431A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "63AF2815-41F3-499D-9BFC-086C623D285C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "D085E87C-4447-465E-9E35-F1BDE7E5C78D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A8DF5075-D458-4C50-99B7-CFFEEFFECBE3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B3C2CACE-22AD-4BA1-BEF7-6C9BE89E2851",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BA1D4E9B-A698-4908-BFD8-E50F5F7989A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.3.3:*:*:*:*:*:*:*",
"matchCriteriaId": "14D06FBE-3BAB-4628-B702-F34FBDC5C36C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "5AC40D1E-2A40-4477-AC8D-712437CDD034",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "9148299E-E783-4508-BC5C-6A269A1944C5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 before 2.3.6 does not properly restrict access to files in the WEB-INF directory, which allows remote attackers to obtain sensitive information via a direct request. NOTE: this identifier has been SPLIT due to different researchers and different vulnerability types. See CVE-2014-2857 for the META-INF variant and CVE-2014-2858 for the directory traversal."
},
{
"lang": "es",
"value": "La configuraci\u00f3n por defecto del plugin Resources 1.0.0 anterior a 1.2.6 para Pivotal Grails 2.0.0 anterior a 2.3.6 no restringe correctamente el acceso a archivos en el directorio WEB-INF, lo que permite a atacantes remotos obtener informaci\u00f3n sensible a trav\u00e9s de una petici\u00f3n directa. NOTA: este identificador ha sido dividido (SPLIT) debido a diferentes investigadores y diferentes tipos de vulnerabilidades. Ver CVE-2014-2857 para la variante META-INF y para el salto de directorio CVE-2014-2858."
}
],
"id": "CVE-2014-0053",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-04-15T23:55:08.640",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0194.html"
},
{
"source": "secalert@redhat.com",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0267.html"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/56841"
},
{
"source": "secalert@redhat.com",
"url": "http://www.gopivotal.com/security/cve-2014-0053"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securityfocus.com/archive/1/531281/100/0/threaded"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securityfocus.com/bid/65678"
},
{
"source": "secalert@redhat.com",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/91270"
},
{
"source": "secalert@redhat.com",
"url": "https://twitter.com/Ramsharan065/status/434975409134792704"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0194.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0267.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/56841"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.gopivotal.com/security/cve-2014-0053"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/531281/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/65678"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/91270"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://twitter.com/Ramsharan065/status/434975409134792704"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2014-2858
Vulnerability from fkie_nvd - Published: 2014-04-15 23:55 - Updated: 2025-04-12 10:46
Severity ?
Summary
Directory traversal vulnerability in the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 allows remote attackers to obtain sensitive information via unspecified vectors related to a "configured block." NOTE: this issue was SPLIT from CVE-2014-0053 per ADT2 due to different vulnerability types.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "BB4F4992-DAD4-43E4-A2D0-A00D585A2D31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FEB18D96-BB77-4C80-9534-F78B95687CEA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3D8A6B18-29FE-4194-8EFC-5543E1A46BC4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4B1FC971-D192-43D1-BD86-19E99ADF5C87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "5A9BE413-E5A0-442F-B9B7-69F8EDD91FB8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "48203D48-8A45-4648-981A-F28BE13282B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "E280C52A-2F26-4D14-B1E0-8FA25181E856",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "04574C35-A00D-49CC-8C50-301C7FC643F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A11BBF2D-4489-4111-98A1-AA0B89A15DC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "07D5A44B-5748-4AE4-9C8F-1718011961D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "C5BDE522-11D1-45AF-B60F-7F4022D85714",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "9039FCCF-740D-4320-BA11-BF9BCD7809CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "979685AE-AFA1-47A0-BC5E-BC06EFCF02DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "9DD08D54-5FA6-4E2D-8264-1FE8907D756A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E2B5FC64-83CC-49D3-BFDD-494763AB1FEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EE1BBB9C-39B5-40CB-A12C-E33B7E35CB18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6581AEB4-7049-4D84-9FB2-F5B58096BC60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "23CF1A57-C941-4198-8F18-5618D8C07DD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "44DAA96C-1916-4100-8936-4353A3DC26A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "29342858-3173-45A5-91BF-81689593C960",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FAF7A322-5AE4-450C-B939-4D6B448766D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4ACEC5A6-FE19-423E-BF40-B5574C648A99",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "38C46B0E-3D30-4D22-9DF4-161FA5DE773D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "828398A1-EF0C-4193-8D85-A91475162BFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "5AEC8808-6358-4D4F-8984-8D2A341D67E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7391B773-22CC-43D1-9848-F1DA14537049",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "446CEA94-E3B0-45A8-B491-EF7F1EA4D74D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1F330DB8-2576-44F1-A10C-7E3985FDFF9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "B6BF47B6-6338-4A4B-B7B2-BB83F5D2431A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "63AF2815-41F3-499D-9BFC-086C623D285C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "D085E87C-4447-465E-9E35-F1BDE7E5C78D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A8DF5075-D458-4C50-99B7-CFFEEFFECBE3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B3C2CACE-22AD-4BA1-BEF7-6C9BE89E2851",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BA1D4E9B-A698-4908-BFD8-E50F5F7989A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.3.3:*:*:*:*:*:*:*",
"matchCriteriaId": "14D06FBE-3BAB-4628-B702-F34FBDC5C36C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "5AC40D1E-2A40-4477-AC8D-712437CDD034",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "9148299E-E783-4508-BC5C-6A269A1944C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.3.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6F4E1C85-2EE7-405B-B3EF-54B0B37E8624",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 allows remote attackers to obtain sensitive information via unspecified vectors related to a \"configured block.\" NOTE: this issue was SPLIT from CVE-2014-0053 per ADT2 due to different vulnerability types."
},
{
"lang": "es",
"value": "Vulnerabilidad de salto de directorio en el plugin Resources 1.0.0 anterior a 1.2.6 para Pivotal Grails 2.0.0 hasta 2.3.6 permite a atacantes remotos obtener informaci\u00f3n sensible a trav\u00e9s de vectores desconocidos relacionados con un \"bloque configurado.\" NOTA: este problema fue dividido (SPLIT) de CVE-2014-0053 por ADT2 debido a diferentes tipos de vulnerabilidades."
}
],
"id": "CVE-2014-2858",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-04-15T23:55:08.780",
"references": [
{
"source": "cve@mitre.org",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0267.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.gopivotal.com/security/cve-2014-0053"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/531281/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0267.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.gopivotal.com/security/cve-2014-0053"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/531281/100/0/threaded"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2014-2857
Vulnerability from fkie_nvd - Published: 2014-04-15 23:55 - Updated: 2025-04-12 10:46
Severity ?
Summary
The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 does not properly restrict access to files in the META-INF directory, which allows remote attackers to obtain sensitive information via a direct request. NOTE: this issue was SPLIT from CVE-2014-0053 due to different researchers per ADT5.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "BB4F4992-DAD4-43E4-A2D0-A00D585A2D31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FEB18D96-BB77-4C80-9534-F78B95687CEA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3D8A6B18-29FE-4194-8EFC-5543E1A46BC4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4B1FC971-D192-43D1-BD86-19E99ADF5C87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "5A9BE413-E5A0-442F-B9B7-69F8EDD91FB8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "48203D48-8A45-4648-981A-F28BE13282B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "E280C52A-2F26-4D14-B1E0-8FA25181E856",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "04574C35-A00D-49CC-8C50-301C7FC643F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A11BBF2D-4489-4111-98A1-AA0B89A15DC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "07D5A44B-5748-4AE4-9C8F-1718011961D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "C5BDE522-11D1-45AF-B60F-7F4022D85714",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "9039FCCF-740D-4320-BA11-BF9BCD7809CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "979685AE-AFA1-47A0-BC5E-BC06EFCF02DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails-resources:1.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "9DD08D54-5FA6-4E2D-8264-1FE8907D756A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E2B5FC64-83CC-49D3-BFDD-494763AB1FEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EE1BBB9C-39B5-40CB-A12C-E33B7E35CB18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6581AEB4-7049-4D84-9FB2-F5B58096BC60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "23CF1A57-C941-4198-8F18-5618D8C07DD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "44DAA96C-1916-4100-8936-4353A3DC26A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "29342858-3173-45A5-91BF-81689593C960",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FAF7A322-5AE4-450C-B939-4D6B448766D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4ACEC5A6-FE19-423E-BF40-B5574C648A99",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "38C46B0E-3D30-4D22-9DF4-161FA5DE773D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "828398A1-EF0C-4193-8D85-A91475162BFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "5AEC8808-6358-4D4F-8984-8D2A341D67E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7391B773-22CC-43D1-9848-F1DA14537049",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "446CEA94-E3B0-45A8-B491-EF7F1EA4D74D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1F330DB8-2576-44F1-A10C-7E3985FDFF9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "B6BF47B6-6338-4A4B-B7B2-BB83F5D2431A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "63AF2815-41F3-499D-9BFC-086C623D285C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "D085E87C-4447-465E-9E35-F1BDE7E5C78D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A8DF5075-D458-4C50-99B7-CFFEEFFECBE3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B3C2CACE-22AD-4BA1-BEF7-6C9BE89E2851",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BA1D4E9B-A698-4908-BFD8-E50F5F7989A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.3.3:*:*:*:*:*:*:*",
"matchCriteriaId": "14D06FBE-3BAB-4628-B702-F34FBDC5C36C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "5AC40D1E-2A40-4477-AC8D-712437CDD034",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "9148299E-E783-4508-BC5C-6A269A1944C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gopivotal:grails:2.3.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6F4E1C85-2EE7-405B-B3EF-54B0B37E8624",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 does not properly restrict access to files in the META-INF directory, which allows remote attackers to obtain sensitive information via a direct request. NOTE: this issue was SPLIT from CVE-2014-0053 due to different researchers per ADT5."
},
{
"lang": "es",
"value": "La configuraci\u00f3n por defecto del plugin Resources 1.0.0 anterior a 1.2.6 para Pivotal Grails 2.0.0 hasta 2.3.6 no restringe debidamente acceso a archivos en el directorio META-INF, lo que permite a atacantes remotos obtener informaci\u00f3n sensible a trav\u00e9s de una solicitud directa. NOTA: este problema fue dividido (SPLIT) de CVE-2014-0053 debido a investigadores diferentes por ADT5."
}
],
"id": "CVE-2014-2857",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-04-15T23:55:08.720",
"references": [
{
"source": "cve@mitre.org",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0267.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.gopivotal.com/security/cve-2014-0053"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/531281/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0267.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.gopivotal.com/security/cve-2014-0053"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/531281/100/0/threaded"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CVE-2016-6521 (GCVE-0-2016-6521)
Vulnerability from cvelistv5 – Published: 2017-01-23 21:00 – Updated: 2024-08-06 01:29
VLAI?
Summary
Cross-site request forgery (CSRF) vulnerability in Grails console (aka Grails Debug Console and Grails Web Console) 2.0.7, 1.5.10, and earlier allows remote attackers to hijack the authentication of users for requests that execute arbitrary Groovy code via unspecified vectors.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:29:20.320Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20160801 CVE Request: CSRF in Grails console",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2016/08/02/2"
},
{
"name": "[oss-security] 20160802 Re: CVE Request: CSRF in Grails console",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2016/08/02/11"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/sheehan/grails-console/issues/54"
},
{
"name": "92267",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/92267"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/sheehan/grails-console/issues/55"
},
{
"name": "[oss-security] 20160803 Grails Console is still vulnerable to CSRF CVE-2016-6521",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2016/08/03/9"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-07-01T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in Grails console (aka Grails Debug Console and Grails Web Console) 2.0.7, 1.5.10, and earlier allows remote attackers to hijack the authentication of users for requests that execute arbitrary Groovy code via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-01-24T10:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[oss-security] 20160801 CVE Request: CSRF in Grails console",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2016/08/02/2"
},
{
"name": "[oss-security] 20160802 Re: CVE Request: CSRF in Grails console",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2016/08/02/11"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/sheehan/grails-console/issues/54"
},
{
"name": "92267",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/92267"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/sheehan/grails-console/issues/55"
},
{
"name": "[oss-security] 20160803 Grails Console is still vulnerable to CSRF CVE-2016-6521",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2016/08/03/9"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-6521",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site request forgery (CSRF) vulnerability in Grails console (aka Grails Debug Console and Grails Web Console) 2.0.7, 1.5.10, and earlier allows remote attackers to hijack the authentication of users for requests that execute arbitrary Groovy code via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20160801 CVE Request: CSRF in Grails console",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2016/08/02/2"
},
{
"name": "[oss-security] 20160802 Re: CVE Request: CSRF in Grails console",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2016/08/02/11"
},
{
"name": "https://github.com/sheehan/grails-console/issues/54",
"refsource": "CONFIRM",
"url": "https://github.com/sheehan/grails-console/issues/54"
},
{
"name": "92267",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/92267"
},
{
"name": "https://github.com/sheehan/grails-console/issues/55",
"refsource": "CONFIRM",
"url": "https://github.com/sheehan/grails-console/issues/55"
},
{
"name": "[oss-security] 20160803 Grails Console is still vulnerable to CSRF CVE-2016-6521",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2016/08/03/9"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-6521",
"datePublished": "2017-01-23T21:00:00",
"dateReserved": "2016-08-02T00:00:00",
"dateUpdated": "2024-08-06T01:29:20.320Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-0053 (GCVE-0-2014-0053)
Vulnerability from cvelistv5 – Published: 2014-04-15 18:00 – Updated: 2024-08-06 09:05
VLAI?
Summary
The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 before 2.3.6 does not properly restrict access to files in the WEB-INF directory, which allows remote attackers to obtain sensitive information via a direct request. NOTE: this identifier has been SPLIT due to different researchers and different vulnerability types. See CVE-2014-2857 for the META-INF variant and CVE-2014-2858 for the directory traversal.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T09:05:38.568Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "56841",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/56841"
},
{
"name": "grails-cve20140053-info-disc(91270)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/91270"
},
{
"name": "20140227 Update: CVE-2014-0053 Information Disclosure when using Grails",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/531281/100/0/threaded"
},
{
"name": "65678",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/65678"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.gopivotal.com/security/cve-2014-0053"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://twitter.com/Ramsharan065/status/434975409134792704"
},
{
"name": "20140227 Update: CVE-2014-0053 Information Disclosure when using Grails",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0267.html"
},
{
"name": "20140219 CVE-2014-0053 Information Disclosure when using Grails",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0194.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-02-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 before 2.3.6 does not properly restrict access to files in the WEB-INF directory, which allows remote attackers to obtain sensitive information via a direct request. NOTE: this identifier has been SPLIT due to different researchers and different vulnerability types. See CVE-2014-2857 for the META-INF variant and CVE-2014-2858 for the directory traversal."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-09T18:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "56841",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/56841"
},
{
"name": "grails-cve20140053-info-disc(91270)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/91270"
},
{
"name": "20140227 Update: CVE-2014-0053 Information Disclosure when using Grails",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/531281/100/0/threaded"
},
{
"name": "65678",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/65678"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.gopivotal.com/security/cve-2014-0053"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://twitter.com/Ramsharan065/status/434975409134792704"
},
{
"name": "20140227 Update: CVE-2014-0053 Information Disclosure when using Grails",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0267.html"
},
{
"name": "20140219 CVE-2014-0053 Information Disclosure when using Grails",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0194.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2014-0053",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 before 2.3.6 does not properly restrict access to files in the WEB-INF directory, which allows remote attackers to obtain sensitive information via a direct request. NOTE: this identifier has been SPLIT due to different researchers and different vulnerability types. See CVE-2014-2857 for the META-INF variant and CVE-2014-2858 for the directory traversal."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "56841",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/56841"
},
{
"name": "grails-cve20140053-info-disc(91270)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/91270"
},
{
"name": "20140227 Update: CVE-2014-0053 Information Disclosure when using Grails",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/531281/100/0/threaded"
},
{
"name": "65678",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/65678"
},
{
"name": "http://www.gopivotal.com/security/cve-2014-0053",
"refsource": "CONFIRM",
"url": "http://www.gopivotal.com/security/cve-2014-0053"
},
{
"name": "https://twitter.com/Ramsharan065/status/434975409134792704",
"refsource": "MISC",
"url": "https://twitter.com/Ramsharan065/status/434975409134792704"
},
{
"name": "20140227 Update: CVE-2014-0053 Information Disclosure when using Grails",
"refsource": "FULLDISC",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0267.html"
},
{
"name": "20140219 CVE-2014-0053 Information Disclosure when using Grails",
"refsource": "FULLDISC",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0194.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2014-0053",
"datePublished": "2014-04-15T18:00:00",
"dateReserved": "2013-12-03T00:00:00",
"dateUpdated": "2024-08-06T09:05:38.568Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-2857 (GCVE-0-2014-2857)
Vulnerability from cvelistv5 – Published: 2014-04-15 18:00 – Updated: 2024-08-06 10:28
VLAI?
Summary
The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 does not properly restrict access to files in the META-INF directory, which allows remote attackers to obtain sensitive information via a direct request. NOTE: this issue was SPLIT from CVE-2014-0053 due to different researchers per ADT5.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T10:28:46.187Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20140227 Update: CVE-2014-0053 Information Disclosure when using Grails",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/531281/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.gopivotal.com/security/cve-2014-0053"
},
{
"name": "20140227 Update: CVE-2014-0053 Information Disclosure when using Grails",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0267.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-02-27T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 does not properly restrict access to files in the META-INF directory, which allows remote attackers to obtain sensitive information via a direct request. NOTE: this issue was SPLIT from CVE-2014-0053 due to different researchers per ADT5."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-09T18:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20140227 Update: CVE-2014-0053 Information Disclosure when using Grails",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/531281/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.gopivotal.com/security/cve-2014-0053"
},
{
"name": "20140227 Update: CVE-2014-0053 Information Disclosure when using Grails",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0267.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-2857",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 does not properly restrict access to files in the META-INF directory, which allows remote attackers to obtain sensitive information via a direct request. NOTE: this issue was SPLIT from CVE-2014-0053 due to different researchers per ADT5."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20140227 Update: CVE-2014-0053 Information Disclosure when using Grails",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/531281/100/0/threaded"
},
{
"name": "http://www.gopivotal.com/security/cve-2014-0053",
"refsource": "CONFIRM",
"url": "http://www.gopivotal.com/security/cve-2014-0053"
},
{
"name": "20140227 Update: CVE-2014-0053 Information Disclosure when using Grails",
"refsource": "FULLDISC",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0267.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-2857",
"datePublished": "2014-04-15T18:00:00",
"dateReserved": "2014-04-15T00:00:00",
"dateUpdated": "2024-08-06T10:28:46.187Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-2858 (GCVE-0-2014-2858)
Vulnerability from cvelistv5 – Published: 2014-04-15 18:00 – Updated: 2024-08-06 10:28
VLAI?
Summary
Directory traversal vulnerability in the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 allows remote attackers to obtain sensitive information via unspecified vectors related to a "configured block." NOTE: this issue was SPLIT from CVE-2014-0053 per ADT2 due to different vulnerability types.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T10:28:46.371Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20140227 Update: CVE-2014-0053 Information Disclosure when using Grails",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/531281/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.gopivotal.com/security/cve-2014-0053"
},
{
"name": "20140227 Update: CVE-2014-0053 Information Disclosure when using Grails",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0267.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-02-27T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 allows remote attackers to obtain sensitive information via unspecified vectors related to a \"configured block.\" NOTE: this issue was SPLIT from CVE-2014-0053 per ADT2 due to different vulnerability types."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-09T18:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20140227 Update: CVE-2014-0053 Information Disclosure when using Grails",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/531281/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.gopivotal.com/security/cve-2014-0053"
},
{
"name": "20140227 Update: CVE-2014-0053 Information Disclosure when using Grails",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0267.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-2858",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Directory traversal vulnerability in the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 allows remote attackers to obtain sensitive information via unspecified vectors related to a \"configured block.\" NOTE: this issue was SPLIT from CVE-2014-0053 per ADT2 due to different vulnerability types."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20140227 Update: CVE-2014-0053 Information Disclosure when using Grails",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/531281/100/0/threaded"
},
{
"name": "http://www.gopivotal.com/security/cve-2014-0053",
"refsource": "CONFIRM",
"url": "http://www.gopivotal.com/security/cve-2014-0053"
},
{
"name": "20140227 Update: CVE-2014-0053 Information Disclosure when using Grails",
"refsource": "FULLDISC",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0267.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-2858",
"datePublished": "2014-04-15T18:00:00",
"dateReserved": "2014-04-15T00:00:00",
"dateUpdated": "2024-08-06T10:28:46.371Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2016-6521 (GCVE-0-2016-6521)
Vulnerability from nvd – Published: 2017-01-23 21:00 – Updated: 2024-08-06 01:29
VLAI?
Summary
Cross-site request forgery (CSRF) vulnerability in Grails console (aka Grails Debug Console and Grails Web Console) 2.0.7, 1.5.10, and earlier allows remote attackers to hijack the authentication of users for requests that execute arbitrary Groovy code via unspecified vectors.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:29:20.320Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20160801 CVE Request: CSRF in Grails console",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2016/08/02/2"
},
{
"name": "[oss-security] 20160802 Re: CVE Request: CSRF in Grails console",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2016/08/02/11"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/sheehan/grails-console/issues/54"
},
{
"name": "92267",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/92267"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/sheehan/grails-console/issues/55"
},
{
"name": "[oss-security] 20160803 Grails Console is still vulnerable to CSRF CVE-2016-6521",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2016/08/03/9"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-07-01T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in Grails console (aka Grails Debug Console and Grails Web Console) 2.0.7, 1.5.10, and earlier allows remote attackers to hijack the authentication of users for requests that execute arbitrary Groovy code via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-01-24T10:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[oss-security] 20160801 CVE Request: CSRF in Grails console",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2016/08/02/2"
},
{
"name": "[oss-security] 20160802 Re: CVE Request: CSRF in Grails console",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2016/08/02/11"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/sheehan/grails-console/issues/54"
},
{
"name": "92267",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/92267"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/sheehan/grails-console/issues/55"
},
{
"name": "[oss-security] 20160803 Grails Console is still vulnerable to CSRF CVE-2016-6521",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2016/08/03/9"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-6521",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site request forgery (CSRF) vulnerability in Grails console (aka Grails Debug Console and Grails Web Console) 2.0.7, 1.5.10, and earlier allows remote attackers to hijack the authentication of users for requests that execute arbitrary Groovy code via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20160801 CVE Request: CSRF in Grails console",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2016/08/02/2"
},
{
"name": "[oss-security] 20160802 Re: CVE Request: CSRF in Grails console",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2016/08/02/11"
},
{
"name": "https://github.com/sheehan/grails-console/issues/54",
"refsource": "CONFIRM",
"url": "https://github.com/sheehan/grails-console/issues/54"
},
{
"name": "92267",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/92267"
},
{
"name": "https://github.com/sheehan/grails-console/issues/55",
"refsource": "CONFIRM",
"url": "https://github.com/sheehan/grails-console/issues/55"
},
{
"name": "[oss-security] 20160803 Grails Console is still vulnerable to CSRF CVE-2016-6521",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2016/08/03/9"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-6521",
"datePublished": "2017-01-23T21:00:00",
"dateReserved": "2016-08-02T00:00:00",
"dateUpdated": "2024-08-06T01:29:20.320Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-0053 (GCVE-0-2014-0053)
Vulnerability from nvd – Published: 2014-04-15 18:00 – Updated: 2024-08-06 09:05
VLAI?
Summary
The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 before 2.3.6 does not properly restrict access to files in the WEB-INF directory, which allows remote attackers to obtain sensitive information via a direct request. NOTE: this identifier has been SPLIT due to different researchers and different vulnerability types. See CVE-2014-2857 for the META-INF variant and CVE-2014-2858 for the directory traversal.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T09:05:38.568Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "56841",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/56841"
},
{
"name": "grails-cve20140053-info-disc(91270)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/91270"
},
{
"name": "20140227 Update: CVE-2014-0053 Information Disclosure when using Grails",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/531281/100/0/threaded"
},
{
"name": "65678",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/65678"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.gopivotal.com/security/cve-2014-0053"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://twitter.com/Ramsharan065/status/434975409134792704"
},
{
"name": "20140227 Update: CVE-2014-0053 Information Disclosure when using Grails",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0267.html"
},
{
"name": "20140219 CVE-2014-0053 Information Disclosure when using Grails",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0194.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-02-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 before 2.3.6 does not properly restrict access to files in the WEB-INF directory, which allows remote attackers to obtain sensitive information via a direct request. NOTE: this identifier has been SPLIT due to different researchers and different vulnerability types. See CVE-2014-2857 for the META-INF variant and CVE-2014-2858 for the directory traversal."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-09T18:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "56841",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/56841"
},
{
"name": "grails-cve20140053-info-disc(91270)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/91270"
},
{
"name": "20140227 Update: CVE-2014-0053 Information Disclosure when using Grails",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/531281/100/0/threaded"
},
{
"name": "65678",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/65678"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.gopivotal.com/security/cve-2014-0053"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://twitter.com/Ramsharan065/status/434975409134792704"
},
{
"name": "20140227 Update: CVE-2014-0053 Information Disclosure when using Grails",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0267.html"
},
{
"name": "20140219 CVE-2014-0053 Information Disclosure when using Grails",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0194.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2014-0053",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 before 2.3.6 does not properly restrict access to files in the WEB-INF directory, which allows remote attackers to obtain sensitive information via a direct request. NOTE: this identifier has been SPLIT due to different researchers and different vulnerability types. See CVE-2014-2857 for the META-INF variant and CVE-2014-2858 for the directory traversal."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "56841",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/56841"
},
{
"name": "grails-cve20140053-info-disc(91270)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/91270"
},
{
"name": "20140227 Update: CVE-2014-0053 Information Disclosure when using Grails",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/531281/100/0/threaded"
},
{
"name": "65678",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/65678"
},
{
"name": "http://www.gopivotal.com/security/cve-2014-0053",
"refsource": "CONFIRM",
"url": "http://www.gopivotal.com/security/cve-2014-0053"
},
{
"name": "https://twitter.com/Ramsharan065/status/434975409134792704",
"refsource": "MISC",
"url": "https://twitter.com/Ramsharan065/status/434975409134792704"
},
{
"name": "20140227 Update: CVE-2014-0053 Information Disclosure when using Grails",
"refsource": "FULLDISC",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0267.html"
},
{
"name": "20140219 CVE-2014-0053 Information Disclosure when using Grails",
"refsource": "FULLDISC",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0194.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2014-0053",
"datePublished": "2014-04-15T18:00:00",
"dateReserved": "2013-12-03T00:00:00",
"dateUpdated": "2024-08-06T09:05:38.568Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-2857 (GCVE-0-2014-2857)
Vulnerability from nvd – Published: 2014-04-15 18:00 – Updated: 2024-08-06 10:28
VLAI?
Summary
The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 does not properly restrict access to files in the META-INF directory, which allows remote attackers to obtain sensitive information via a direct request. NOTE: this issue was SPLIT from CVE-2014-0053 due to different researchers per ADT5.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T10:28:46.187Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20140227 Update: CVE-2014-0053 Information Disclosure when using Grails",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/531281/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.gopivotal.com/security/cve-2014-0053"
},
{
"name": "20140227 Update: CVE-2014-0053 Information Disclosure when using Grails",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0267.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-02-27T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 does not properly restrict access to files in the META-INF directory, which allows remote attackers to obtain sensitive information via a direct request. NOTE: this issue was SPLIT from CVE-2014-0053 due to different researchers per ADT5."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-09T18:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20140227 Update: CVE-2014-0053 Information Disclosure when using Grails",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/531281/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.gopivotal.com/security/cve-2014-0053"
},
{
"name": "20140227 Update: CVE-2014-0053 Information Disclosure when using Grails",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0267.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-2857",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 does not properly restrict access to files in the META-INF directory, which allows remote attackers to obtain sensitive information via a direct request. NOTE: this issue was SPLIT from CVE-2014-0053 due to different researchers per ADT5."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20140227 Update: CVE-2014-0053 Information Disclosure when using Grails",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/531281/100/0/threaded"
},
{
"name": "http://www.gopivotal.com/security/cve-2014-0053",
"refsource": "CONFIRM",
"url": "http://www.gopivotal.com/security/cve-2014-0053"
},
{
"name": "20140227 Update: CVE-2014-0053 Information Disclosure when using Grails",
"refsource": "FULLDISC",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0267.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-2857",
"datePublished": "2014-04-15T18:00:00",
"dateReserved": "2014-04-15T00:00:00",
"dateUpdated": "2024-08-06T10:28:46.187Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-2858 (GCVE-0-2014-2858)
Vulnerability from nvd – Published: 2014-04-15 18:00 – Updated: 2024-08-06 10:28
VLAI?
Summary
Directory traversal vulnerability in the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 allows remote attackers to obtain sensitive information via unspecified vectors related to a "configured block." NOTE: this issue was SPLIT from CVE-2014-0053 per ADT2 due to different vulnerability types.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T10:28:46.371Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20140227 Update: CVE-2014-0053 Information Disclosure when using Grails",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/531281/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.gopivotal.com/security/cve-2014-0053"
},
{
"name": "20140227 Update: CVE-2014-0053 Information Disclosure when using Grails",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0267.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-02-27T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 allows remote attackers to obtain sensitive information via unspecified vectors related to a \"configured block.\" NOTE: this issue was SPLIT from CVE-2014-0053 per ADT2 due to different vulnerability types."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-09T18:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20140227 Update: CVE-2014-0053 Information Disclosure when using Grails",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/531281/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.gopivotal.com/security/cve-2014-0053"
},
{
"name": "20140227 Update: CVE-2014-0053 Information Disclosure when using Grails",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0267.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-2858",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Directory traversal vulnerability in the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 allows remote attackers to obtain sensitive information via unspecified vectors related to a \"configured block.\" NOTE: this issue was SPLIT from CVE-2014-0053 per ADT2 due to different vulnerability types."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20140227 Update: CVE-2014-0053 Information Disclosure when using Grails",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/531281/100/0/threaded"
},
{
"name": "http://www.gopivotal.com/security/cve-2014-0053",
"refsource": "CONFIRM",
"url": "http://www.gopivotal.com/security/cve-2014-0053"
},
{
"name": "20140227 Update: CVE-2014-0053 Information Disclosure when using Grails",
"refsource": "FULLDISC",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0267.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-2858",
"datePublished": "2014-04-15T18:00:00",
"dateReserved": "2014-04-15T00:00:00",
"dateUpdated": "2024-08-06T10:28:46.371Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}