Improper Neutralization of Special Elements in Output Used by a Downstream Component in Apache Groovy

🗓️ 13 May 2022 01:25:41Reported by GitHub Advisory DatabaseType

Improper Neutralization of Special Elements in Output Used by a Downstream Component in Apache Groovy. MethodClosure class allows remote code execution and denial of service via crafted serialized object

Reporter	Title	Published	Views	Family All 95
0day.today	Apache Groovy 2.4.x Disclosure Vulnerabilities	18 Jul 201500:00	–	zdt
0day.today	Apache Groovy Deserialization of Untrusted Data Remote Code Execution Exploit 0day	24 Jul 201500:00	–	zdt
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Open Source software used by Cloud Pak System	31 Mar 202314:10	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Apache Groovy that could affect IBM Development Package for Apache Spark (CVE-2015-3253)	15 Jun 201807:05	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Commons Collections and Apache Groovy affects IBM UrbanCode Build (CVE-2015-7450, CVE-2015-3253)	17 Jun 201822:32	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities of Apache Groovy (groovy-all-2.3.11.jar) have affected APM JBoss and APM WebLogic Agent [CVE-202-17521, CVE-2016-6814, CVE-2015-3253]	3 Jul 202311:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Spectrum Control is vulnerable to multiple weaknesses related to Apache Groovy	7 Mar 202304:51	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Groovy affect IBM Cloud Pak System [CVE-2016-6814, CVE-2015-3253]	10 Jan 202411:22	–	ibm
FreeBSD	groovy -- remote execution of untrusted code/DoS vulnerability	20 Sep 201600:00	–	freebsd
FreeBSD	groovy -- remote execution of untrusted code	9 Jul 201500:00	–	freebsd

Vulners

Node

org.codehaus.groovy groovy-allRange1.7.0–2.4.3maven

org.codehaus.groovy groovyRange1.7.0–2.4.3maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2015-3253
access	www.access.redhat.com/errata/RHSA-2016:1376
access	www.access.redhat.com/errata/RHSA-2017:2486
access	www.access.redhat.com/errata/RHSA-2017:2596
h20566	www.h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay
lists	www.lists.apache.org/thread.html/rbb8e16cc5acab183124572b655bdf5fe1d5b5f477dc267352426c7ed@%3Cnotifications.shardingsphere.apache.org%3E
security	www.security.gentoo.org/glsa/201610-01
oracle	www.oracle.com/security-alerts/cpuapr2020.html
oracle	www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
groovy-lang	www.groovy-lang.org/security.html

17 Oct 2024 16:17Current

9.3High risk

Vulners AI Score9.3

CVSS 27.5

CVSS 39.8

EPSS0.64446

CWE-74