GitHub Advisoryadvisory · Maven

GHSA-qg25-hgjv-cg9q Improper Neutralization of Special Elements in Output Used by a Downstream Component in Apache Groovy

CRITICAL Published 2022-05-13 Modified 2024-10-17 Official page ↗
Aliases
CVE-2015-3253
Ecosystem
Maven
Packages
org.codehaus.groovy:groovy, org.codehaus.groovy:groovy-all
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-74
Reviewed
2022-07-06

Affected packages

• Maven org.codehaus.groovy:groovy: >= 1.7.0, < 2.4.4 → fixed in 2.4.4 • Maven org.codehaus.groovy:groovy-all: >= 1.7.0, < 2.4.4 → fixed in 2.4.4

Description

The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.

Related

Alias · CVE (1)

  • CVE-2015-3253 The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary… vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References