GitHub Advisoryadvisory · Maven

GHSA-pmxf-4v8c-rwr7 Incorrect Resource Transfer Between Spheres in Grails

HIGH Published 2022-05-24 Modified 2022-06-28 Official page ↗
Aliases
CVE-2019-12728
Ecosystem
Maven
Packages
org.grails:grails-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-494, CWE-669
Reviewed
2022-06-28

Affected packages

• Maven org.grails:grails-core: < 3.3.10 → fixed in 3.3.10

Description

Grails before 3.3.10 used cleartext HTTP to resolve the SDKMan notification service. NOTE: users' apps were not resolving dependencies over cleartext HTTP.

Related

Alias · CVE (1)

  • CVE-2019-12728 Grails before 3.3.10 used cleartext HTTP to resolve the SDKMan notification service. vulnerability

Weakness · CWE (2)

  • CWE-494 Download of Code Without Integrity Check weakness
  • CWE-669 Incorrect Resource Transfer Between Spheres weakness

References