Apache Groovy Deserialization of Untrusted Data Remote Code Execution Vulnerability

🗓️ 20 Jul 2015 00:00:00Reported by cpnrodzc7Type

zdi

zdi🔗 www.zerodayinitiative.com👁 117 Views

Apache Groovy Untrusted Data Remote Code Executio

Reporter	Title	Published	Views	Family All 95
0day.today	Apache Groovy 2.4.x Disclosure Vulnerabilities	18 Jul 201500:00	–	zdt
0day.today	Apache Groovy Deserialization of Untrusted Data Remote Code Execution Exploit 0day	24 Jul 201500:00	–	zdt
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Open Source software used by Cloud Pak System	31 Mar 202314:10	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Apache Groovy that could affect IBM Development Package for Apache Spark (CVE-2015-3253)	15 Jun 201807:05	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Commons Collections and Apache Groovy affects IBM UrbanCode Build (CVE-2015-7450, CVE-2015-3253)	17 Jun 201822:32	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities of Apache Groovy (groovy-all-2.3.11.jar) have affected APM JBoss and APM WebLogic Agent [CVE-202-17521, CVE-2016-6814, CVE-2015-3253]	3 Jul 202311:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Spectrum Control is vulnerable to multiple weaknesses related to Apache Groovy	7 Mar 202304:51	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Groovy affect IBM Cloud Pak System [CVE-2016-6814, CVE-2015-3253]	10 Jan 202411:22	–	ibm
FreeBSD	groovy -- remote execution of untrusted code/DoS vulnerability	20 Sep 201600:00	–	freebsd
FreeBSD	groovy -- remote execution of untrusted code	9 Jul 201500:00	–	freebsd

Source	Link
groovy-lang	www.groovy-lang.org/security.html
elastic	www.elastic.co/community/security

20 Jul 2015 00:00Current

9.4High risk

Vulners AI Score9.4

CVSS 27.5

EPSS0.44303

apache groovy deserialization remote code execution vulnerability authentication closure implementation java serialized binary stream