CVE-2022-41923 – Grails Spring Security Core plugin vulnerable to privilege escalation

https://notcve.org/view.php?id=CVE-2022-41923

23 Nov 2022 — Grails Spring Security Core plugin is vulnerable to privilege escalation. The vulnerability allows an attacker access to one endpoint (i.e. the targeted endpoint) using the authorization requirements of a different endpoint (i.e. the donor endpoint). In some Grails framework applications, access to the targeted endpoint will be granted based on meeting the authorization requirements of the donor endpoint, which can result in a privilege escalation attack. This vulnerability has been patched in grails-spring... • https://github.com/grails/GSSC-CVE-2022-41923 • CWE-269: Improper Privilege Management CWE-863: Incorrect Authorization •