CVSS: 5.0EPSS: 0%CPEs: 38EXPL: 0CVE-2014-2857
https://notcve.org/view.php?id=CVE-2014-2857
The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 does not properly restrict access to files in the META-INF directory, which allows remote attackers to obtain sensitive information via a direct request. NOTE: this issue was SPLIT from CVE-2014-0053 due to different researchers per ADT5. La configuración por defecto del plugin Resources 1.0.0 anterior a 1.2.6 para Pivotal Grails 2.0.0 hasta 2.3.6 no restringe debidamente acceso a archivos en el directorio META-INF, lo que permite a atacantes remotos obtener información sensible a través de una solicitud directa. NOTA: este problema fue dividido (SPLIT) de CVE-2014-0053 debido a investigadores diferentes por ADT5. • http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0267.html http://www.gopivotal.com/security/cve-2014-0053 http://www.securityfocus.com/archive/1/531281/100/0/threaded • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.0EPSS: 0%CPEs: 37EXPL: 0CVE-2014-0053
https://notcve.org/view.php?id=CVE-2014-0053
The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 before 2.3.6 does not properly restrict access to files in the WEB-INF directory, which allows remote attackers to obtain sensitive information via a direct request. NOTE: this identifier has been SPLIT due to different researchers and different vulnerability types. See CVE-2014-2857 for the META-INF variant and CVE-2014-2858 for the directory traversal. La configuración por defecto del plugin Resources 1.0.0 anterior a 1.2.6 para Pivotal Grails 2.0.0 anterior a 2.3.6 no restringe correctamente el acceso a archivos en el directorio WEB-INF, lo que permite a atacantes remotos obtener información sensible a través de una petición directa. NOTA: este identificador ha sido dividido (SPLIT) debido a diferentes investigadores y diferentes tipos de vulnerabilidades. • http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0194.html http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0267.html http://secunia.com/advisories/56841 http://www.gopivotal.com/security/cve-2014-0053 http://www.securityfocus.com/archive/1/531281/100/0/threaded http://www.securityfocus.com/bid/65678 https://exchange.xforce.ibmcloud.com/vulnerabilities/91270 https://twitter.com/Ramsharan065/status/434975409134792704 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.0EPSS: 0%CPEs: 16EXPL: 1CVE-2012-1833
https://notcve.org/view.php?id=CVE-2012-1833
VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which might allow remote attackers to bypass intended access restrictions and modify arbitrary object properties via a crafted request parameter to an application. VMware SpringSource Grails antes de v1.3.8, y v2.x antes de v2.0.2, no restringe correctamente el enlace a los datos, lo que podría permitir a atacantes remotos eludir las restricciones de acceso y modificar las propiedades de objetos de su elección a través de un parámetro modificado en una petición a la aplicación. • http://secunia.com/advisories/51113 http://support.springsource.com/security/cve-2012-1833 http://www.securityfocus.com/bid/55763 • CWE-264: Permissions, Privileges, and Access Controls •