CVE-2023-46131
Grails® data binding causes JVM crash and/or DoS
Severity Score
7.5
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Grails is a framework used to build web applications with the Groovy programming language. A specially crafted web request can lead to a JVM crash or denial of service. Any Grails framework application using Grails data binding is vulnerable. This issue has been patched in version 3.3.17, 4.1.3, 5.3.4, 6.1.0.
Grails es un framework utilizado para crear aplicaciones web con el lenguaje de programación Groovy. Una solicitud web especialmente manipulada puede provocar un fallo de JVM o una denegación de servicio. Cualquier aplicación del framework de Grails que utilice el enlace de datos de Grails es vulnerable. Este problema se solucionó en las versiones 3.3.17, 4.1.3, 5.3.4, 6.1.0.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2023-10-16 CVE Reserved
- 2023-12-20 CVE Published
- 2024-08-02 CVE Updated
- 2024-11-19 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-400: Uncontrolled Resource Consumption
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| https://github.com/grails/grails-core/issues/13302 | Issue Tracking |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/grails/grails-core/security/advisories/GHSA-3pjv-r7w4-2cf5 | 2024-01-02 | |
| https://grails.org/blog/2023-12-20-cve-data-binding-dos.html | 2024-01-02 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Grails Search vendor "Grails" | Grails Search vendor "Grails" for product "Grails" | < 3.3.17 Search vendor "Grails" for product "Grails" and version " < 3.3.17" | - |
Affected
| ||||||
| Grails Search vendor "Grails" | Grails Search vendor "Grails" for product "Grails" | >= 4.0.0 < 4.1.3 Search vendor "Grails" for product "Grails" and version " >= 4.0.0 < 4.1.3" | - |
Affected
| ||||||
| Grails Search vendor "Grails" | Grails Search vendor "Grails" for product "Grails" | >= 5.0.0 < 5.3.4 Search vendor "Grails" for product "Grails" and version " >= 5.0.0 < 5.3.4" | - |
Affected
| ||||||
| Grails Search vendor "Grails" | Grails Search vendor "Grails" for product "Grails" | >= 6.0.0 < 6.1.0 Search vendor "Grails" for product "Grails" and version " >= 6.0.0 < 6.1.0" | - |
Affected
| ||||||