CVE-2018-1000817: Improper Limitation of a Pathname to a Restricted Directory

Asset Pipeline Grails Plugin Asset-pipeline plugin version Prior to 2.14.1.1, 2.15.1 and 3.0.6 contains a Incorrect Access Control vulnerability in Applications deployed in Jetty that can result in Download .class files and any arbitrary file. This attack appear to be exploitable via Specially...

PT-2018-9541

Name of the Vulnerable Software and Affected Versions Asset Pipeline Grails Plugin versions prior to 2.14.1.1 Asset Pipeline Grails Plugin versions prior to 2.15.1 Asset Pipeline Grails Plugin versions prior to 3.0.6 Description The issue is related to Incorrect Access Control in Applications...

org.grails:gorm-hibernate4-spring-boot (1.0.0.m1), org.grails:grails-datastore-gorm (>=3.0.0.release, <=3.0.1.release) +28 more potentially affected by CVE-2018-1000529 via org.grails:grails-core (2.3.6)

org.grails:grails-core MAVEN version 2.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:gorm-hibernate4-spring-boot 1.0.0.m1 - org.grails:grails-datastore-gorm =3.0.0.release, =3.0.0.release,...

org.grails:grails-crud (1.2.1), org.grails:grails-gorm (1.2.1) +4 more potentially affected by CVE-2018-1000529 via org.grails:grails-core (1.2.1)

org.grails:grails-core MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-crud 1.2.1 - org.grails:grails-gorm 1.2.1 - org.grails:grails-maven-plugin 1.2.1 -...

org.grails:grails-logging (2.4.0.m1), org.grails:grails-plugin-async (2.4.0.m1) +19 more potentially affected by CVE-2018-1000529 via org.grails:grails-core (2.4.0.m1)

org.grails:grails-core MAVEN version 2.4.0.m1 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-logging 2.4.0.m1 - org.grails:grails-plugin-async 2.4.0.m1 - org.grails:grails-plugin-codecs...

org.grails:grails-dependencies (2.3.5), org.grails:grails-logging (2.3.5) +20 more potentially affected by CVE-2018-1000529 via org.grails:grails-core (2.3.5)

org.grails:grails-core MAVEN version 2.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-dependencies 2.3.5 - org.grails:grails-logging 2.3.5 - org.grails:grails-plugin-async 2.3.5 -...

org.grails:gorm-hibernate4-spring-boot (>=1.0.0.rc1, <=1.0.0.rc2), org.grails:gorm-mongodb-spring-boot (>=1.0.0.m1, <=1.0.0.rc1) +30 more potentially affected by CVE-2018-1000529 via org.grails:grails-core (2.3.7)

org.grails:grails-core MAVEN version 2.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:gorm-hibernate4-spring-boot =1.0.0.rc1, =1.0.0.m1, =3.0.2.release, =3.0.2.release, =3.0.2.release,...

org.grails:grails-logging (2.3.10), org.grails:grails-plugin-async (2.3.10) +19 more potentially affected by CVE-2018-1000529 via org.grails:grails-core (2.3.10)

org.grails:grails-core MAVEN version 2.3.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-logging 2.3.10 - org.grails:grails-plugin-async 2.3.10 - org.grails:grails-plugin-codecs 2.3.10 ...

org.grails:grails-encoder (2.4.0.m2), org.grails:grails-gsp-spring-boot (1.0.0.m1) +32 more potentially affected by CVE-2018-1000529 via org.grails:grails-core (2.4.0.m2)

org.grails:grails-core MAVEN version 2.4.0.m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-encoder 2.4.0.m2 - org.grails:grails-gsp-spring-boot 1.0.0.m1 - org.grails:grails-logging...

org.grails:grails-dependencies (2.4.0.rc1), org.grails:grails-encoder (2.4.0.rc1) +33 more potentially affected by CVE-2018-1000529 via org.grails:grails-core (2.4.0.rc1)

org.grails:grails-core MAVEN version 2.4.0.rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-dependencies 2.4.0.rc1 - org.grails:grails-encoder 2.4.0.rc1 -...

org.grails:grails-dependencies (2.4.4), org.grails:grails-encoder (2.4.4) +34 more potentially affected by CVE-2018-1000529 via org.grails:grails-core (2.4.4)

org.grails:grails-core MAVEN version 2.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-dependencies 2.4.4 - org.grails:grails-encoder 2.4.4 - org.grails:grails-gsp-spring-boot 1.0.0 -...

org.grails:grails-dependencies (2.5.4), org.grails:grails-encoder (2.5.4) +33 more potentially affected by CVE-2018-1000529 via org.grails:grails-core (2.5.4)

org.grails:grails-core MAVEN version 2.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-dependencies 2.5.4 - org.grails:grails-encoder 2.5.4 - org.grails:grails-logging 2.5.4 -...

org.grails:grails-datastore-gorm-grails2-support (>=6.0.0.rc1, <=6.1.0.rc2), org.grails:grails-datastore-gorm-grails2-test (>=6.0.0.rc1, <=6.1.0.rc2) +35 more potentially affected by CVE-2018-1000529 via org.grails:grails-core (2.5.5)

org.grails:grails-core MAVEN version 2.5.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-datastore-gorm-grails2-support =6.0.0.rc1, =6.0.0.rc1, =6.1.0.rc2 - org.grails:grails-dependencie...

org.grails:grails-datastore-gorm (>=2.0.5.release, <=2.0.7.release), org.grails:grails-datastore-gorm-hibernate (>=2.0.5.release, <=2.0.7.release) +27 more potentially affected by CVE-2018-1000529 via org.grails:grails-core (2.3.4)

org.grails:grails-core MAVEN version 2.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-datastore-gorm =2.0.5.release, =2.0.5.release, =2.0.5.release, =2.0.0-m01, =2.0.5.release,...

org.grails:grails-datastore-gorm (3.1.2.release), org.grails:grails-datastore-gorm-hibernate (3.1.2.release) +29 more potentially affected by CVE-2018-1000529 via org.grails:grails-core (2.3.9)

org.grails:grails-core MAVEN version 2.3.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-datastore-gorm 3.1.2.release - org.grails:grails-datastore-gorm-hibernate 3.1.2.release -...

org.grails:grails-dependencies (2.4.0), org.grails:grails-encoder (2.4.0) +32 more potentially affected by CVE-2018-1000529 via org.grails:grails-core (2.4.0)

org.grails:grails-core MAVEN version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-dependencies 2.4.0 - org.grails:grails-encoder 2.4.0 - org.grails:grails-logging 2.4.0 -...

org.grails:grails-dependencies (2.5.1), org.grails:grails-encoder (2.5.1) +33 more potentially affected by CVE-2018-1000529 via org.grails:grails-core (2.5.1)

org.grails:grails-core MAVEN version 2.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-dependencies 2.5.1 - org.grails:grails-encoder 2.5.1 - org.grails:grails-logging 2.5.1 -...

org.grails:grails-datastore-gorm-grails2-support (>=6.1.0.release, <=6.1.9.release), org.grails:grails-datastore-gorm-grails2-test (>=6.1.0.release, <=6.1.9.release) +35 more potentially affected by CVE-2018-1000529 via org.grails:grails-core (2.5.6)

org.grails:grails-core MAVEN version 2.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-datastore-gorm-grails2-support =6.1.0.release, =6.1.0.release, =6.1.9.release -...

org.grails:grails-crud (1.2-m4), org.grails:grails-docs (1.2-m4) +4 more potentially affected by CVE-2018-1000529 via org.grails:grails-core (1.2-m4)

org.grails:grails-core MAVEN version 1.2-m4 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-crud 1.2-m4 - org.grails:grails-docs 1.2-m4 - org.grails:grails-gorm 1.2-m4 -...

org.grails:grails-crud (1.2.0), org.grails:grails-gorm (1.2.0) +4 more potentially affected by CVE-2018-1000529 via org.grails:grails-core (1.2.0)

org.grails:grails-core MAVEN version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-crud 1.2.0 - org.grails:grails-gorm 1.2.0 - org.grails:grails-maven-plugin 1.2.0 -...