Search criteria
3 vulnerabilities found for grails by springsource
FKIE_CVE-2012-1833
Vulnerability from fkie_nvd - Published: 2012-09-28 21:55 - Updated: 2025-04-11 00:51
Severity ?
Summary
VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which might allow remote attackers to bypass intended access restrictions and modify arbitrary object properties via a crafted request parameter to an application.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| springsource | grails | * | |
| springsource | grails | 1.1.0 | |
| springsource | grails | 1.1.1 | |
| springsource | grails | 1.1.2 | |
| springsource | grails | 1.2.0 | |
| springsource | grails | 1.2.1 | |
| springsource | grails | 1.2.2 | |
| springsource | grails | 1.3.0 | |
| springsource | grails | 1.3.1 | |
| springsource | grails | 1.3.2 | |
| springsource | grails | 1.3.3 | |
| springsource | grails | 1.3.4 | |
| springsource | grails | 1.3.5 | |
| springsource | grails | 1.3.6 | |
| springsource | grails | 2.0 | |
| springsource | grails | 2.0.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:springsource:grails:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CB4B4EEA-6E01-4959-BCB8-F563F93AFBD6",
"versionEndIncluding": "1.3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:springsource:grails:1.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "57941BFE-B83D-407F-BCD4-E5D8F1F3591C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:springsource:grails:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "370ABCD3-C65E-4846-8919-742C24CE1D4B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:springsource:grails:1.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "99A577FE-66CD-4811-A6BE-697B2E49F189",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:springsource:grails:1.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4729D1E4-B5E5-40B0-8875-A5D1F39BADB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:springsource:grails:1.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4B478BFF-ECF4-42FF-9D0B-38AD1F2D310B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:springsource:grails:1.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A1A56F17-3D0C-44CB-A849-5207D38C5A04",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:springsource:grails:1.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "04CF86D4-71F4-490B-A966-DAD0FE69316D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:springsource:grails:1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "56AB86B6-BC70-4DBC-90E2-90D54F4E8E3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:springsource:grails:1.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "EE86A736-F4F8-4772-B085-C6FFB32DE81D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:springsource:grails:1.3.3:*:*:*:*:*:*:*",
"matchCriteriaId": "75E5A0A8-91CB-430D-A80E-09FDA3DF4A1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:springsource:grails:1.3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "84520A33-BA43-49CE-BF16-2918F42B9EF0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:springsource:grails:1.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "71B6BE41-F82A-44AB-9017-41C830F204C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:springsource:grails:1.3.6:*:*:*:*:*:*:*",
"matchCriteriaId": "862CBB40-7346-489F-96C5-13EE57A37EBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:springsource:grails:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F928FB64-7693-496D-921C-E80107573DF2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:springsource:grails:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B6C20EF3-8E52-4AD9-9FCD-AFD04D8EF32A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which might allow remote attackers to bypass intended access restrictions and modify arbitrary object properties via a crafted request parameter to an application."
},
{
"lang": "es",
"value": "VMware SpringSource Grails antes de v1.3.8, y v2.x antes de v2.0.2, no restringe correctamente el enlace a los datos, lo que podr\u00eda permitir a atacantes remotos eludir las restricciones de acceso y modificar las propiedades de objetos de su elecci\u00f3n a trav\u00e9s de un par\u00e1metro modificado en una petici\u00f3n a la aplicaci\u00f3n."
}
],
"id": "CVE-2012-1833",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2012-09-28T21:55:01.007",
"references": [
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/51113"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://support.springsource.com/security/cve-2012-1833"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/55763"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/51113"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://support.springsource.com/security/cve-2012-1833"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/55763"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CVE-2012-1833 (GCVE-0-2012-1833)
Vulnerability from cvelistv5 – Published: 2012-09-28 21:00 – Updated: 2024-08-06 19:08
VLAI?
Summary
VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which might allow remote attackers to bypass intended access restrictions and modify arbitrary object properties via a crafted request parameter to an application.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T19:08:38.690Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "51113",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/51113"
},
{
"name": "55763",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/55763"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://support.springsource.com/security/cve-2012-1833"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-08-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which might allow remote attackers to bypass intended access restrictions and modify arbitrary object properties via a crafted request parameter to an application."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-02-12T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "51113",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/51113"
},
{
"name": "55763",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/55763"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://support.springsource.com/security/cve-2012-1833"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-1833",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which might allow remote attackers to bypass intended access restrictions and modify arbitrary object properties via a crafted request parameter to an application."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "51113",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/51113"
},
{
"name": "55763",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/55763"
},
{
"name": "http://support.springsource.com/security/cve-2012-1833",
"refsource": "CONFIRM",
"url": "http://support.springsource.com/security/cve-2012-1833"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-1833",
"datePublished": "2012-09-28T21:00:00",
"dateReserved": "2012-03-21T00:00:00",
"dateUpdated": "2024-08-06T19:08:38.690Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-1833 (GCVE-0-2012-1833)
Vulnerability from nvd – Published: 2012-09-28 21:00 – Updated: 2024-08-06 19:08
VLAI?
Summary
VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which might allow remote attackers to bypass intended access restrictions and modify arbitrary object properties via a crafted request parameter to an application.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T19:08:38.690Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "51113",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/51113"
},
{
"name": "55763",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/55763"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://support.springsource.com/security/cve-2012-1833"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-08-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which might allow remote attackers to bypass intended access restrictions and modify arbitrary object properties via a crafted request parameter to an application."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-02-12T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "51113",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/51113"
},
{
"name": "55763",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/55763"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://support.springsource.com/security/cve-2012-1833"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-1833",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which might allow remote attackers to bypass intended access restrictions and modify arbitrary object properties via a crafted request parameter to an application."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "51113",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/51113"
},
{
"name": "55763",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/55763"
},
{
"name": "http://support.springsource.com/security/cve-2012-1833",
"refsource": "CONFIRM",
"url": "http://support.springsource.com/security/cve-2012-1833"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-1833",
"datePublished": "2012-09-28T21:00:00",
"dateReserved": "2012-03-21T00:00:00",
"dateUpdated": "2024-08-06T19:08:38.690Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}