GoogleOSV:GHSA-3PJV-R7W4-2CF5Grails data binding causes JVM crash and/or other denial of service
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
6.9 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
25.3%
Impact
A specially crafted web request can lead to a JVM crash or denial of service. Any Grails framework application using Grails data binding is vulnerable.
Patches
Patches are available for Grails 3 and later.
Workarounds
No workaround is possible except to avoid data binding to request data.
References
References
github.com/grails/grails-core
github.com/grails/grails-core/commit/74326bdd2cf7dcb594092165e9464520f8366c60
github.com/grails/grails-core/commit/c401faaa6c24c021c758b95f72304a0e855a8db3
github.com/grails/grails-core/issues/13302
github.com/grails/grails-core/security/advisories/GHSA-3pjv-r7w4-2cf5
grails.org/blog/2023-12-20-cve-data-binding-dos.html
nvd.nist.gov/vuln/detail/CVE-2023-46131
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
6.9 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
25.3%