PatchTheCVEgrails vulnerabilities
Recent CVEs affecting grails products. 7 tracked.
grails has 7 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 5. Most recent: 2023-12-21. Highest priority: CVE-2022-35912 (score 60/100).
- CVE-2023-46131 MEDIUM 6.5 UPGRADE Grails is a framework used to build web applications with the Groovy programming language
- CVE-2022-41923 CRITICAL 9.1 UPGRADE Grails Spring Security Core plugin is vulnerable to privilege escalation
- CVE-2022-35912 CRITICAL 9.8 UPGRADE In grails-databinding in Grails before 3.3.15, 4.x before 4.1.1, 5.x before 5.1.9, and 5.2.x before 5.2.1 (at
- CVE-2019-12728 HIGH 8.1 UPGRADE Grails before 3.3.10 used cleartext HTTP to resolve the SDKMan notification service
- CVE-2018-1000529 MEDIUM 6.1 DOWNGRADE Grails Fields plugin version 2.2.7 contains a Cross Site Scripting (XSS) vulnerability in Using the display ta
- CVE-2017-6344 MEDIUM 5.9 DOWNGRADE XML External Entity (XXE) vulnerability in Grails PDF Plugin 0.6 allows remote attackers to read arbitrary fil
- CVE-2014-3626 HIGH 7.5 UPGRADE The Grails Resource Plugin often has to exchange URIs for resources with other internal components
FAQ
How do I fix grails vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is grails being exploited right now?
None of the tracked grails CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which grails CVE should I patch first?
CVE-2022-35912 currently ranks highest (60/100): In grails-databinding in Grails before 3.3.15, 4.x before 4.1.1, 5.x before 5.1.9, and 5.2.x before 5.2.1 (at .