PatchTheCVECVE-2015-3253: The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attac
69
This week
CRITICAL 9.8REMOTEWATCHLISTDOWNGRADEDOWNGRADEDOWNGRADE
CVE-2015-3253 is a critical-severity flaw (CVSS 9.8) affecting groovy, health sciences clinical development center, retail order broker cloud service. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.
Why this priority
- Critical severity
- EPSS top 1%: very likely to be exploited
- Remotely exploitable, no login, no user action
- On your watchlist
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 41.0% (top 1%) |
| CISA exploited list | No |
| Weakness | CWE-74 |
| Published | 2015-08-13 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
apache groovy DOWNGRADE
Affected: 1.7.0 · 1.7.0 beta_1 · 1.7.0 beta_2 · 1.7.0 rc1 · 1.7.0 rc2 · 1.7.1 · 1.7.2 · 1.7.3
Fixed in: no fixed release known
Safe to downgrade to: a release before 1.7.0
1. Check installed version
apt-cache policy groovy || rpm -q groovy || groovy --version
2. No fixed release: DOWNGRADE to a release before 1.7.0 (Debian / Ubuntu)
apt-cache madison groovy
sudo apt install groovy=<VERSION_BEFORE_1.7.0>
sudo apt-mark hold groovy
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list groovy
sudo dnf downgrade groovy-<VERSION_BEFORE_1.7.0>
sudo dnf versionlock add groovy
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
oracle health sciences clinical development center DOWNGRADE
Affected: 3.1.1 · 3.1.2
Fixed in: no fixed release known
Safe to downgrade to: a release before 3.1.1
1. Check installed version
apt-cache policy health-sciences-clinical-development-center || rpm -q health-sciences-clinical-development-center || health-sciences-clinical-development-center --version
2. No fixed release: DOWNGRADE to a release before 3.1.1 (Debian / Ubuntu)
apt-cache madison health-sciences-clinical-development-center
sudo apt install health-sciences-clinical-development-center=<VERSION_BEFORE_3.1.1>
sudo apt-mark hold health-sciences-clinical-development-center
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list health-sciences-clinical-development-center
sudo dnf downgrade health-sciences-clinical-development-center-<VERSION_BEFORE_3.1.1>
sudo dnf versionlock add health-sciences-clinical-development-center
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
oracle retail order broker cloud service DOWNGRADE
Affected: 4.1 · 5.1 · 5.2 · 15.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 4.1
1. Check installed version
apt-cache policy retail-order-broker-cloud-service || rpm -q retail-order-broker-cloud-service || retail-order-broker-cloud-service --version
2. No fixed release: DOWNGRADE to a release before 4.1 (Debian / Ubuntu)
apt-cache madison retail-order-broker-cloud-service
sudo apt install retail-order-broker-cloud-service=<VERSION_BEFORE_4.1>
sudo apt-mark hold retail-order-broker-cloud-service
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list retail-order-broker-cloud-service
sudo dnf downgrade retail-order-broker-cloud-service-<VERSION_BEFORE_4.1>
sudo dnf versionlock add retail-order-broker-cloud-service
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
oracle retail service backbone DOWNGRADE
Affected: 13.0 · 13.1 · 13.2 · 14.0 · 14.1 · 15.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 13.0
1. Check installed version
apt-cache policy retail-service-backbone || rpm -q retail-service-backbone || retail-service-backbone --version
2. No fixed release: DOWNGRADE to a release before 13.0 (Debian / Ubuntu)
apt-cache madison retail-service-backbone
sudo apt install retail-service-backbone=<VERSION_BEFORE_13.0>
sudo apt-mark hold retail-service-backbone
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list retail-service-backbone
sudo dnf downgrade retail-service-backbone-<VERSION_BEFORE_13.0>
sudo dnf versionlock add retail-service-backbone
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
oracle retail store inventory management DOWNGRADE
Affected: 13.2 · 14.0 · 14.1
Fixed in: no fixed release known
Safe to downgrade to: a release before 13.2
1. Check installed version
apt-cache policy retail-store-inventory-management || rpm -q retail-store-inventory-management || retail-store-inventory-management --version
2. No fixed release: DOWNGRADE to a release before 13.2 (Debian / Ubuntu)
apt-cache madison retail-store-inventory-management
sudo apt install retail-store-inventory-management=<VERSION_BEFORE_13.2>
sudo apt-mark hold retail-store-inventory-management
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list retail-store-inventory-management
sudo dnf downgrade retail-store-inventory-management-<VERSION_BEFORE_13.2>
sudo dnf versionlock add retail-store-inventory-management
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
oracle webcenter sites DOWNGRADE
Affected: 11.1.1.8.0 · 12.2.1
Fixed in: no fixed release known
Safe to downgrade to: a release before 11.1.1.8.0
1. Check installed version
apt-cache policy webcenter-sites || rpm -q webcenter-sites || webcenter-sites --version
2. No fixed release: DOWNGRADE to a release before 11.1.1.8.0 (Debian / Ubuntu)
apt-cache madison webcenter-sites
sudo apt install webcenter-sites=<VERSION_BEFORE_11.1.1.8.0>
sudo apt-mark hold webcenter-sites
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list webcenter-sites
sudo dnf downgrade webcenter-sites-<VERSION_BEFORE_11.1.1.8.0>
sudo dnf versionlock add webcenter-sites
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2015-3253?
groovy: downgrade or apply the listed mitigation; health sciences clinical development center: downgrade or apply the listed mitigation; retail order broker cloud service: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2015-3253 being exploited?
CVE-2015-3253 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2015-3253 affect?
CVE-2015-3253 affects groovy, health sciences clinical development center, retail order broker cloud service. Severity is critical (CVSS 9.8). The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.
How urgent is CVE-2015-3253?
Priority 69/100. Critical severity; EPSS top 1%: very likely to be exploited; Remotely exploitable, no login, no user action; On your watchlist
Software pages
Related CVEs
- CVE-2020-17521 MEDIUM 5.5 UPGRADE MITIGATE Apache Groovy provides extension methods to aid with creating temporary directories
- CVE-2019-1003033 HIGH 8.8 UPGRADE A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.1 and earlier in pom.xml, src/main/java/hudso
- CVE-2019-1003006 HIGH 8.8 UPGRADE A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.0 and earlier in src/main/java/hudson/plugins
- CVE-2016-6814 CRITICAL 9.8 UPGRADE MITIGATE When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2