Vulnerabilites related to apache - groovy
CVE-2016-6814 (GCVE-0-2016-6814)
Vulnerability from cvelistv5
Published
2018-01-18 18:00
Modified
2024-09-16 20:52
Severity ?
CWE
  • n/a
Summary
When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects were subject to this vulnerability.
References
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T01:43:37.985Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2017:2596",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2596"
          },
          {
            "name": "RHSA-2017:0868",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:0868"
          },
          {
            "name": "RHSA-2017:2486",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2486"
          },
          {
            "name": "RHSA-2017:0272",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2017-0272.html"
          },
          {
            "name": "95429",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/95429"
          },
          {
            "name": "1039600",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1039600"
          },
          {
            "name": "GLSA-202003-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202003-01"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://mail-archives.apache.org/mod_mbox/www-announce/201701.mbox/%3CCADRx3PMZ2hBCGDTY35zYXFGaDnjAs0tc5-upaVs6QN2sYUejyA%40mail.gmail.com%3E"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-01-15T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects were subject to this vulnerability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-07-15T02:22:54",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "RHSA-2017:2596",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2596"
        },
        {
          "name": "RHSA-2017:0868",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:0868"
        },
        {
          "name": "RHSA-2017:2486",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2486"
        },
        {
          "name": "RHSA-2017:0272",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2017-0272.html"
        },
        {
          "name": "95429",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/95429"
        },
        {
          "name": "1039600",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1039600"
        },
        {
          "name": "GLSA-202003-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202003-01"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://mail-archives.apache.org/mod_mbox/www-announce/201701.mbox/%3CCADRx3PMZ2hBCGDTY35zYXFGaDnjAs0tc5-upaVs6QN2sYUejyA%40mail.gmail.com%3E"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "DATE_PUBLIC": "2018-01-15T00:00:00",
          "ID": "CVE-2016-6814",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects were subject to this vulnerability."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2017:2596",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:2596"
            },
            {
              "name": "RHSA-2017:0868",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:0868"
            },
            {
              "name": "RHSA-2017:2486",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:2486"
            },
            {
              "name": "RHSA-2017:0272",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2017-0272.html"
            },
            {
              "name": "95429",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/95429"
            },
            {
              "name": "1039600",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1039600"
            },
            {
              "name": "GLSA-202003-01",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202003-01"
            },
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
            },
            {
              "name": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html",
              "refsource": "CONFIRM",
              "url": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
            },
            {
              "name": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
            },
            {
              "name": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
            },
            {
              "name": "http://mail-archives.apache.org/mod_mbox/www-announce/201701.mbox/%3CCADRx3PMZ2hBCGDTY35zYXFGaDnjAs0tc5-upaVs6QN2sYUejyA%40mail.gmail.com%3E",
              "refsource": "MISC",
              "url": "http://mail-archives.apache.org/mod_mbox/www-announce/201701.mbox/%3CCADRx3PMZ2hBCGDTY35zYXFGaDnjAs0tc5-upaVs6QN2sYUejyA%40mail.gmail.com%3E"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2016-6814",
    "datePublished": "2018-01-18T18:00:00Z",
    "dateReserved": "2016-08-12T00:00:00",
    "dateUpdated": "2024-09-16T20:52:30.155Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-17521 (GCVE-0-2020-17521)
Vulnerability from cvelistv5
Published
2020-12-07 19:22
Modified
2024-08-04 14:00
Severity ?
CWE
  • Information Disclosure
Summary
Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.
References
Impacted products
Vendor Product Version
Apache Software Foundation Apache Groovy Version: 2.0 to 2.4.20
Version: 2.5.0 to 2.5.13
Version: 3.0.0 to 3.0.6
Version: 4.0.0-alpha-1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T14:00:48.677Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://groovy-lang.org/security.html#CVE-2020-17521"
          },
          {
            "name": "[groovy-notifications] 20201207 [jira] [Closed] (GROOVY-9824) CVE-2020-17521 Apache Groovy Information Disclosure",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/ra9dab34bf8625511f23692ad0fcee2725f782e9aad6c5cdff6cf4465%40%3Cnotifications.groovy.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20201218-0006/"
          },
          {
            "name": "[atlas-dev] 20210422 [jira] [Created] (ATLAS-4257) Atlas - Upgrade groovy to 2.4.21+, 2.5.14+, 3.0.7+, or 4.0.0-alpha-2+ due to CVE-2020-17521",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rea63a4666ba245d2892471307772a2d8ce0f0741f341d6576625c1b3%40%3Cdev.atlas.apache.org%3E"
          },
          {
            "name": "[atlas-dev] 20210422 [jira] [Updated] (ATLAS-4257) Atlas - Upgrade groovy to 2.4.21+, 2.5.14+, 3.0.7+, or 4.0.0-alpha-2+ due to CVE-2020-17521",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r4b2f13c302eec98838ff7475253091fb9b75bc1038016ba00ebf6c08%40%3Cdev.atlas.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache Groovy",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "status": "affected",
              "version": "2.0 to 2.4.20"
            },
            {
              "status": "affected",
              "version": "2.5.0 to 2.5.13"
            },
            {
              "status": "affected",
              "version": "3.0.0 to 3.0.6"
            },
            {
              "status": "affected",
              "version": "4.0.0-alpha-1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy\u0027s implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Information Disclosure",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-07-25T16:14:34",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://groovy-lang.org/security.html#CVE-2020-17521"
        },
        {
          "name": "[groovy-notifications] 20201207 [jira] [Closed] (GROOVY-9824) CVE-2020-17521 Apache Groovy Information Disclosure",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/ra9dab34bf8625511f23692ad0fcee2725f782e9aad6c5cdff6cf4465%40%3Cnotifications.groovy.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20201218-0006/"
        },
        {
          "name": "[atlas-dev] 20210422 [jira] [Created] (ATLAS-4257) Atlas - Upgrade groovy to 2.4.21+, 2.5.14+, 3.0.7+, or 4.0.0-alpha-2+ due to CVE-2020-17521",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rea63a4666ba245d2892471307772a2d8ce0f0741f341d6576625c1b3%40%3Cdev.atlas.apache.org%3E"
        },
        {
          "name": "[atlas-dev] 20210422 [jira] [Updated] (ATLAS-4257) Atlas - Upgrade groovy to 2.4.21+, 2.5.14+, 3.0.7+, or 4.0.0-alpha-2+ due to CVE-2020-17521",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r4b2f13c302eec98838ff7475253091fb9b75bc1038016ba00ebf6c08%40%3Cdev.atlas.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2020-17521",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache Groovy",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "2.0 to 2.4.20"
                          },
                          {
                            "version_value": "2.5.0 to 2.5.13"
                          },
                          {
                            "version_value": "3.0.0 to 3.0.6"
                          },
                          {
                            "version_value": "4.0.0-alpha-1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy\u0027s implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Information Disclosure"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://groovy-lang.org/security.html#CVE-2020-17521",
              "refsource": "CONFIRM",
              "url": "https://groovy-lang.org/security.html#CVE-2020-17521"
            },
            {
              "name": "[groovy-notifications] 20201207 [jira] [Closed] (GROOVY-9824) CVE-2020-17521 Apache Groovy Information Disclosure",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/ra9dab34bf8625511f23692ad0fcee2725f782e9aad6c5cdff6cf4465@%3Cnotifications.groovy.apache.org%3E"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20201218-0006/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20201218-0006/"
            },
            {
              "name": "[atlas-dev] 20210422 [jira] [Created] (ATLAS-4257) Atlas - Upgrade groovy to 2.4.21+, 2.5.14+, 3.0.7+, or 4.0.0-alpha-2+ due to CVE-2020-17521",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rea63a4666ba245d2892471307772a2d8ce0f0741f341d6576625c1b3@%3Cdev.atlas.apache.org%3E"
            },
            {
              "name": "[atlas-dev] 20210422 [jira] [Updated] (ATLAS-4257) Atlas - Upgrade groovy to 2.4.21+, 2.5.14+, 3.0.7+, or 4.0.0-alpha-2+ due to CVE-2020-17521",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r4b2f13c302eec98838ff7475253091fb9b75bc1038016ba00ebf6c08@%3Cdev.atlas.apache.org%3E"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuApr2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
            },
            {
              "name": "https://www.oracle.com//security-alerts/cpujul2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2020-17521",
    "datePublished": "2020-12-07T19:22:37",
    "dateReserved": "2020-08-12T00:00:00",
    "dateUpdated": "2024-08-04T14:00:48.677Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-3253 (GCVE-0-2015-3253)
Vulnerability from cvelistv5
Published
2015-08-13 14:00
Modified
2024-08-06 05:39
Severity ?
CWE
  • n/a
Summary
The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.
References
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2017:2596 vendor-advisory, x_refsource_REDHAT
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2016:1376 vendor-advisory, x_refsource_REDHAT
https://security.gentoo.org/glsa/201610-01 vendor-advisory, x_refsource_GENTOO
http://groovy-lang.org/security.html x_refsource_CONFIRM
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755 x_refsource_CONFIRM
http://packetstormsecurity.com/files/132714/Apache-Groovy-2.4.3-Code-Execution.html x_refsource_MISC
https://security.netapp.com/advisory/ntap-20160623-0001/ x_refsource_CONFIRM
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html x_refsource_CONFIRM
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2016-0066.html vendor-advisory, x_refsource_REDHAT
http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html x_refsource_CONFIRM
http://www.securityfocus.com/bid/91787 vdb-entry, x_refsource_BID
http://www.zerodayinitiative.com/advisories/ZDI-15-365/ x_refsource_MISC
https://access.redhat.com/errata/RHSA-2017:2486 vendor-advisory, x_refsource_REDHAT
http://www.securitytracker.com/id/1034815 vdb-entry, x_refsource_SECTRACK
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html x_refsource_CONFIRM
http://www.securityfocus.com/bid/75919 vdb-entry, x_refsource_BID
http://www.securityfocus.com/archive/1/536012/100/0/threaded mailing-list, x_refsource_BUGTRAQ
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html x_refsource_MISC
https://www.oracle.com/security-alerts/cpuapr2020.html x_refsource_MISC
https://lists.apache.org/thread.html/rbb8e16cc5acab183124572b655bdf5fe1d5b5f477dc267352426c7ed%40%3Cnotifications.shardingsphere.apache.org%3E mailing-list, x_refsource_MLIST
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T05:39:32.116Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html"
          },
          {
            "name": "RHSA-2017:2596",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2596"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html"
          },
          {
            "name": "RHSA-2016:1376",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2016:1376"
          },
          {
            "name": "GLSA-201610-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201610-01"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://groovy-lang.org/security.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/132714/Apache-Groovy-2.4.3-Code-Execution.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20160623-0001/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
          },
          {
            "name": "RHSA-2016:0066",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-0066.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html"
          },
          {
            "name": "91787",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/91787"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.zerodayinitiative.com/advisories/ZDI-15-365/"
          },
          {
            "name": "RHSA-2017:2486",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2486"
          },
          {
            "name": "1034815",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1034815"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html"
          },
          {
            "name": "75919",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/75919"
          },
          {
            "name": "20150716 [CVE-2015-3253] Apache Groovy Zero-Day Vulnerability Disclosure",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/536012/100/0/threaded"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
          },
          {
            "name": "[shardingsphere-notifications] 20200623 [GitHub] [shardingsphere] liuqiankun93 opened a new issue #6180: The groovy-2.4.5-indy.jar has High-level security risks",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rbb8e16cc5acab183124572b655bdf5fe1d5b5f477dc267352426c7ed%40%3Cnotifications.shardingsphere.apache.org%3E"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-07-16T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-06-24T04:06:18",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html"
        },
        {
          "name": "RHSA-2017:2596",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2596"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html"
        },
        {
          "name": "RHSA-2016:1376",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2016:1376"
        },
        {
          "name": "GLSA-201610-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201610-01"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://groovy-lang.org/security.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/132714/Apache-Groovy-2.4.3-Code-Execution.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20160623-0001/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
        },
        {
          "name": "RHSA-2016:0066",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-0066.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html"
        },
        {
          "name": "91787",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/91787"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.zerodayinitiative.com/advisories/ZDI-15-365/"
        },
        {
          "name": "RHSA-2017:2486",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2486"
        },
        {
          "name": "1034815",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1034815"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html"
        },
        {
          "name": "75919",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/75919"
        },
        {
          "name": "20150716 [CVE-2015-3253] Apache Groovy Zero-Day Vulnerability Disclosure",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/536012/100/0/threaded"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
        },
        {
          "name": "[shardingsphere-notifications] 20200623 [GitHub] [shardingsphere] liuqiankun93 opened a new issue #6180: The groovy-2.4.5-indy.jar has High-level security risks",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rbb8e16cc5acab183124572b655bdf5fe1d5b5f477dc267352426c7ed%40%3Cnotifications.shardingsphere.apache.org%3E"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2015-3253",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html"
            },
            {
              "name": "RHSA-2017:2596",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:2596"
            },
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html"
            },
            {
              "name": "RHSA-2016:1376",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2016:1376"
            },
            {
              "name": "GLSA-201610-01",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201610-01"
            },
            {
              "name": "http://groovy-lang.org/security.html",
              "refsource": "CONFIRM",
              "url": "http://groovy-lang.org/security.html"
            },
            {
              "name": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755",
              "refsource": "CONFIRM",
              "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755"
            },
            {
              "name": "http://packetstormsecurity.com/files/132714/Apache-Groovy-2.4.3-Code-Execution.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/132714/Apache-Groovy-2.4.3-Code-Execution.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20160623-0001/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20160623-0001/"
            },
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
            },
            {
              "name": "RHSA-2016:0066",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2016-0066.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html"
            },
            {
              "name": "91787",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/91787"
            },
            {
              "name": "http://www.zerodayinitiative.com/advisories/ZDI-15-365/",
              "refsource": "MISC",
              "url": "http://www.zerodayinitiative.com/advisories/ZDI-15-365/"
            },
            {
              "name": "RHSA-2017:2486",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:2486"
            },
            {
              "name": "1034815",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1034815"
            },
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html"
            },
            {
              "name": "75919",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/75919"
            },
            {
              "name": "20150716 [CVE-2015-3253] Apache Groovy Zero-Day Vulnerability Disclosure",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/536012/100/0/threaded"
            },
            {
              "name": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
            },
            {
              "name": "[shardingsphere-notifications] 20200623 [GitHub] [shardingsphere] liuqiankun93 opened a new issue #6180: The groovy-2.4.5-indy.jar has High-level security risks",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rbb8e16cc5acab183124572b655bdf5fe1d5b5f477dc267352426c7ed@%3Cnotifications.shardingsphere.apache.org%3E"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2015-3253",
    "datePublished": "2015-08-13T14:00:00",
    "dateReserved": "2015-04-10T00:00:00",
    "dateUpdated": "2024-08-06T05:39:32.116Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Vulnerability from fkie_nvd
Published
2018-01-18 18:29
Modified
2024-11-21 02:56
Severity ?
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects were subject to this vulnerability.
References
cve@mitre.orghttp://mail-archives.apache.org/mod_mbox/www-announce/201701.mbox/%3CCADRx3PMZ2hBCGDTY35zYXFGaDnjAs0tc5-upaVs6QN2sYUejyA%40mail.gmail.com%3EPatch, Vendor Advisory
cve@mitre.orghttp://rhn.redhat.com/errata/RHSA-2017-0272.htmlBroken Link
cve@mitre.orghttp://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
cve@mitre.orghttp://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
cve@mitre.orghttp://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
cve@mitre.orghttp://www.securityfocus.com/bid/95429Third Party Advisory, VDB Entry
cve@mitre.orghttp://www.securitytracker.com/id/1039600Third Party Advisory, VDB Entry
cve@mitre.orghttps://access.redhat.com/errata/RHSA-2017:0868Broken Link
cve@mitre.orghttps://access.redhat.com/errata/RHSA-2017:2486Third Party Advisory
cve@mitre.orghttps://access.redhat.com/errata/RHSA-2017:2596Third Party Advisory
cve@mitre.orghttps://security.gentoo.org/glsa/202003-01
cve@mitre.orghttps://www.oracle.com/security-alerts/cpujan2020.html
cve@mitre.orghttps://www.oracle.com/security-alerts/cpujul2020.html
cve@mitre.orghttps://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
cve@mitre.orghttps://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
cve@mitre.orghttps://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
af854a3a-2127-422b-91ae-364da2661108http://mail-archives.apache.org/mod_mbox/www-announce/201701.mbox/%3CCADRx3PMZ2hBCGDTY35zYXFGaDnjAs0tc5-upaVs6QN2sYUejyA%40mail.gmail.com%3EPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2017-0272.htmlBroken Link
af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/95429Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1039600Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2017:0868Broken Link
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2017:2486Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2017:2596Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202003-01
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujan2020.html
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujul2020.html
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
Impacted products
Vendor Product Version
apache groovy *
apache groovy *
redhat enterprise_linux_server 7.0


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:groovy:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6EB4409D-39D4-4F6B-AD3E-2E9B0997B6A1",
              "versionEndIncluding": "2.4.3",
              "versionStartIncluding": "1.7.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C8F237F9-F70E-4815-BA42-5B5E8152965C",
              "versionEndIncluding": "2.4.7",
              "versionStartIncluding": "2.4.4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "51EF4996-72F4-4FA4-814F-F5991E7A8318",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects were subject to this vulnerability."
    },
    {
      "lang": "es",
      "value": "Cuando una aplicaci\u00f3n con versiones de Codehaus no soportadas de Groovy desde la versi\u00f3n 1.7.0 hasta la 2.4.3 o Apache Groovy desde la versi\u00f3n 2.4.4 hasta la 2.4.7 en classpath usa mecanismos est\u00e1ndar de serializaci\u00f3n de Java (por ejemplo, para comunicarse entre servidores o almacenar datos locales), un atacante pudo preparar un objeto especialmente serializado que ejecutar\u00e1 c\u00f3digo directamente al ser deserializado. Todas las aplicaciones que dependen de la serializaci\u00f3n y no a\u00edslan el c\u00f3digo que deserializa objetos estaban sujetos a esta vulnerabilidad."
    }
  ],
  "id": "CVE-2016-6814",
  "lastModified": "2024-11-21T02:56:53.077",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2018-01-18T18:29:00.233",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://mail-archives.apache.org/mod_mbox/www-announce/201701.mbox/%3CCADRx3PMZ2hBCGDTY35zYXFGaDnjAs0tc5-upaVs6QN2sYUejyA%40mail.gmail.com%3E"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Broken Link"
      ],
      "url": "http://rhn.redhat.com/errata/RHSA-2017-0272.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/95429"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securitytracker.com/id/1039600"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Broken Link"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2017:0868"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2017:2486"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2017:2596"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://security.gentoo.org/glsa/202003-01"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://mail-archives.apache.org/mod_mbox/www-announce/201701.mbox/%3CCADRx3PMZ2hBCGDTY35zYXFGaDnjAs0tc5-upaVs6QN2sYUejyA%40mail.gmail.com%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link"
      ],
      "url": "http://rhn.redhat.com/errata/RHSA-2017-0272.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/95429"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securitytracker.com/id/1039600"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2017:0868"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2017:2486"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2017:2596"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://security.gentoo.org/glsa/202003-01"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2020-12-07 20:15
Modified
2024-11-21 05:08
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.
References
security@apache.orghttps://groovy-lang.org/security.html#CVE-2020-17521Third Party Advisory
security@apache.orghttps://lists.apache.org/thread.html/r4b2f13c302eec98838ff7475253091fb9b75bc1038016ba00ebf6c08%40%3Cdev.atlas.apache.org%3E
security@apache.orghttps://lists.apache.org/thread.html/ra9dab34bf8625511f23692ad0fcee2725f782e9aad6c5cdff6cf4465%40%3Cnotifications.groovy.apache.org%3E
security@apache.orghttps://lists.apache.org/thread.html/rea63a4666ba245d2892471307772a2d8ce0f0741f341d6576625c1b3%40%3Cdev.atlas.apache.org%3E
security@apache.orghttps://security.netapp.com/advisory/ntap-20201218-0006/Third Party Advisory
security@apache.orghttps://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
security@apache.orghttps://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
security@apache.orghttps://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
security@apache.orghttps://www.oracle.com/security-alerts/cpujan2021.htmlPatch, Third Party Advisory
security@apache.orghttps://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
security@apache.orghttps://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory
security@apache.orghttps://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://groovy-lang.org/security.html#CVE-2020-17521Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r4b2f13c302eec98838ff7475253091fb9b75bc1038016ba00ebf6c08%40%3Cdev.atlas.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/ra9dab34bf8625511f23692ad0fcee2725f782e9aad6c5cdff6cf4465%40%3Cnotifications.groovy.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/rea63a4666ba245d2892471307772a2d8ce0f0741f341d6576625c1b3%40%3Cdev.atlas.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20201218-0006/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujan2021.htmlPatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
Impacted products
Vendor Product Version
apache groovy *
apache groovy *
apache groovy *
apache groovy 4.0.0
netapp snapcenter -
oracle agile_engineering_data_management 6.2.1.0
oracle agile_plm 9.3.3
oracle agile_plm 9.3.6
oracle agile_plm_mcad_connector 3.4
oracle agile_plm_mcad_connector 3.6
oracle business_process_management_suite 12.2.1.3.0
oracle business_process_management_suite 12.2.1.4.0
oracle communications_brm_-_elastic_charging_engine 11.3.0.9.0
oracle communications_brm_-_elastic_charging_engine 12.0.0.3
oracle communications_diameter_signaling_router 8.4.0.0
oracle communications_evolved_communications_application_server 7.1
oracle communications_services_gatekeeper 6.0
oracle communications_services_gatekeeper 6.1
oracle communications_services_gatekeeper 7.0
oracle healthcare_data_repository 7.0.2
oracle hospitality_opera_5 5.6
oracle ilearning 6.2
oracle ilearning 6.3
oracle insurance_policy_administration *
oracle jd_edwards_enterpriseone_orchestrator 9.2.6.0
oracle primavera_gateway *
oracle primavera_unifier *
oracle primavera_unifier 16.1
oracle primavera_unifier 16.2
oracle primavera_unifier 18.8
oracle primavera_unifier 19.12
oracle primavera_unifier 20.12
oracle retail_bulk_data_integration 15.0.3.0
oracle retail_bulk_data_integration 16.0.3.0
oracle retail_merchandising_system 16.0.3
oracle retail_store_inventory_management 14.1.3.10
oracle retail_store_inventory_management 15.0.3.5
oracle retail_store_inventory_management 16.0.3.5
apache atlas 2.1.0


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:groovy:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "456A1063-1BEE-435C-8767-0A994A1E4F9E",
              "versionEndIncluding": "2.4.20",
              "versionStartIncluding": "2.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C3AA8344-EDA5-4DD3-8A06-0AA3588420E5",
              "versionEndIncluding": "2.5.13",
              "versionStartIncluding": "2.5.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AC0AC067-60A2-4A32-9A4A-0C24F8BE9D7B",
              "versionEndIncluding": "3.0.6",
              "versionStartIncluding": "3.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:4.0.0:alpha1:*:*:*:*:*:*",
              "matchCriteriaId": "9A1B3EB0-63AD-41DA-920E-5DF8BCF6217A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "BDFB1169-41A0-4A86-8E4F-FDA9730B1E94",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "80C9DBB8-3D50-4D5D-859A-B022EB7C2E64",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:agile_plm:9.3.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "D14ABF04-E460-4911-9C6C-B7BCEFE68E9D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "C650FEDB-E903-4C2D-AD40-282AB5F2E3C2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:agile_plm_mcad_connector:3.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "C80E730D-EE38-4E85-A9F8-86D7F44A8488",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:agile_plm_mcad_connector:3.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "B0C0714E-4255-4095-B26C-70EB193B8F98",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "E869C417-C0E6-4FC3-B406-45598A1D1906",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DFEFE2C0-7B98-44F9-B3AD-D6EC607E90DA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:11.3.0.9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "0971C780-60F9-4272-9D97-686896F9983A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "06594847-96ED-4541-B2F4-C7331B603603",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_diameter_signaling_router:8.4.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "4A4D2E02-D02C-43F0-9A5A-DE359112C8F3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "987811D5-DA5E-493D-8709-F9231A84E5F9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_services_gatekeeper:6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "BA4E8A1E-FBB5-4EAC-9A7F-6FE95A1B5F60",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_services_gatekeeper:6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "F3287751-9F54-4806-81D2-E28A42DF1407",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "062E4E7C-55BB-46F3-8B61-5A663B565891",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:healthcare_data_repository:7.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "E03F5DEF-DDD7-4C8C-90EF-7E4BCDEFE34B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:hospitality_opera_5:5.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "95D6A426-B914-401F-9AB0-5F5E3A3FE138",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:ilearning:6.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "D361A9A8-15B0-4527-868B-80998772F2AB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:ilearning:6.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "4A667A37-59EB-4539-ADCA-D5F789DB6744",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:insurance_policy_administration:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8E883986-13DA-470F-95C4-BEBD0EDFEB9C",
              "versionEndIncluding": "11.3.1",
              "versionStartIncluding": "11.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:9.2.6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "CEEAC2F0-2FD4-455B-BA9E-29F04A060C65",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "890D7B8E-772C-4CB3-B208-ADFB0A1D7AD5",
              "versionEndIncluding": "17.12.10",
              "versionStartIncluding": "17.12.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "08FA59A8-6A62-4B33-8952-D6E658F8DAC9",
              "versionEndIncluding": "17.12",
              "versionStartIncluding": "17.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "D55A54FD-7DD1-49CD-BE81-0BE73990943C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "82EB08C0-2D46-4635-88DF-E54F6452D3A3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "202AD518-2E9B-4062-B063-9858AE1F9CE2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "10864586-270E-4ACF-BDCC-ECFCD299305F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "38340E3C-C452-4370-86D4-355B6B4E0A06",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:retail_bulk_data_integration:15.0.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "254D8CE1-E821-44A6-9CAF-03D03986478B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:retail_bulk_data_integration:16.0.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "360B307A-3D7F-4B38-8248-76CF8318B023",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "F8383028-B719-41FD-9B6A-71F8EB4C5F8D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:retail_store_inventory_management:14.1.3.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "2C5D2391-A8AD-4593-939D-80A6A5839C0E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:retail_store_inventory_management:15.0.3.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "AA07EE18-15DE-4846-AADD-A3AC055DA94B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:retail_store_inventory_management:16.0.3.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "1F01362F-FF62-45EB-91E2-AF4D05011837",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:atlas:2.1.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "4223F0EE-9464-4CAA-9745-BDC5402A02F5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy\u0027s implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2."
    },
    {
      "lang": "es",
      "value": "Apache Groovy provee m\u00e9todos de extensi\u00f3n para ayudar a crear directorios temporales. Antes de esta correcci\u00f3n, la implementaci\u00f3n de Groovy de esos m\u00e9todos de extensi\u00f3n utilizaba una llamada al m\u00e9todo JDK de Java ahora reemplazada que potencialmente no es segura en algunos sistemas operativos en algunos contextos. Los usuarios que no usen los m\u00e9todos de extensi\u00f3n mencionados en el aviso no est\u00e1n afectados, pero es posible que deseen leer el aviso para obtener m\u00e1s detalles. Versiones afectadas: 2.0 hasta 2.4.20, 2.5.0 hasta 2.5.13, 3.0.0 hasta 3.0.6 y 4.0.0-alpha-1. Corregido en las versiones 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2"
    }
  ],
  "id": "CVE-2020-17521",
  "lastModified": "2024-11-21T05:08:16.887",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 2.1,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-12-07T20:15:12.633",
  "references": [
    {
      "source": "security@apache.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://groovy-lang.org/security.html#CVE-2020-17521"
    },
    {
      "source": "security@apache.org",
      "url": "https://lists.apache.org/thread.html/r4b2f13c302eec98838ff7475253091fb9b75bc1038016ba00ebf6c08%40%3Cdev.atlas.apache.org%3E"
    },
    {
      "source": "security@apache.org",
      "url": "https://lists.apache.org/thread.html/ra9dab34bf8625511f23692ad0fcee2725f782e9aad6c5cdff6cf4465%40%3Cnotifications.groovy.apache.org%3E"
    },
    {
      "source": "security@apache.org",
      "url": "https://lists.apache.org/thread.html/rea63a4666ba245d2892471307772a2d8ce0f0741f341d6576625c1b3%40%3Cdev.atlas.apache.org%3E"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20201218-0006/"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://groovy-lang.org/security.html#CVE-2020-17521"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/r4b2f13c302eec98838ff7475253091fb9b75bc1038016ba00ebf6c08%40%3Cdev.atlas.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/ra9dab34bf8625511f23692ad0fcee2725f782e9aad6c5cdff6cf4465%40%3Cnotifications.groovy.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/rea63a4666ba245d2892471307772a2d8ce0f0741f341d6576625c1b3%40%3Cdev.atlas.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20201218-0006/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
    }
  ],
  "sourceIdentifier": "security@apache.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2015-08-13 14:59
Modified
2025-04-12 10:46
Severity ?
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.
References
secalert@redhat.comhttp://groovy-lang.org/security.htmlVendor Advisory
secalert@redhat.comhttp://packetstormsecurity.com/files/132714/Apache-Groovy-2.4.3-Code-Execution.htmlMitigation, Third Party Advisory, VDB Entry
secalert@redhat.comhttp://rhn.redhat.com/errata/RHSA-2016-0066.html
secalert@redhat.comhttp://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.htmlPatch, Third Party Advisory
secalert@redhat.comhttp://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
secalert@redhat.comhttp://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlPatch, Third Party Advisory
secalert@redhat.comhttp://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
secalert@redhat.comhttp://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
secalert@redhat.comhttp://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
secalert@redhat.comhttp://www.securityfocus.com/archive/1/536012/100/0/threaded
secalert@redhat.comhttp://www.securityfocus.com/bid/75919Third Party Advisory, VDB Entry
secalert@redhat.comhttp://www.securityfocus.com/bid/91787Third Party Advisory, VDB Entry
secalert@redhat.comhttp://www.securitytracker.com/id/1034815
secalert@redhat.comhttp://www.zerodayinitiative.com/advisories/ZDI-15-365/Third Party Advisory, VDB Entry
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2016:1376
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2017:2486
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2017:2596
secalert@redhat.comhttps://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755
secalert@redhat.comhttps://lists.apache.org/thread.html/rbb8e16cc5acab183124572b655bdf5fe1d5b5f477dc267352426c7ed%40%3Cnotifications.shardingsphere.apache.org%3E
secalert@redhat.comhttps://security.gentoo.org/glsa/201610-01
secalert@redhat.comhttps://security.netapp.com/advisory/ntap-20160623-0001/
secalert@redhat.comhttps://www.oracle.com/security-alerts/cpuapr2020.html
secalert@redhat.comhttps://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
af854a3a-2127-422b-91ae-364da2661108http://groovy-lang.org/security.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/132714/Apache-Groovy-2.4.3-Code-Execution.htmlMitigation, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2016-0066.html
af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.htmlPatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlPatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/536012/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/75919Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/91787Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1034815
af854a3a-2127-422b-91ae-364da2661108http://www.zerodayinitiative.com/advisories/ZDI-15-365/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2016:1376
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2017:2486
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2017:2596
af854a3a-2127-422b-91ae-364da2661108https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/rbb8e16cc5acab183124572b655bdf5fe1d5b5f477dc267352426c7ed%40%3Cnotifications.shardingsphere.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/201610-01
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20160623-0001/
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuapr2020.html
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
Impacted products
Vendor Product Version
apache groovy 1.7.0
apache groovy 1.7.0
apache groovy 1.7.0
apache groovy 1.7.0
apache groovy 1.7.0
apache groovy 1.7.1
apache groovy 1.7.2
apache groovy 1.7.3
apache groovy 1.7.4
apache groovy 1.7.5
apache groovy 1.7.6
apache groovy 1.7.7
apache groovy 1.7.8
apache groovy 1.7.9
apache groovy 1.7.10
apache groovy 1.7.11
apache groovy 1.8.0
apache groovy 1.8.0
apache groovy 1.8.0
apache groovy 1.8.0
apache groovy 1.8.0
apache groovy 1.8.0
apache groovy 1.8.0
apache groovy 1.8.0
apache groovy 1.8.0
apache groovy 1.8.1
apache groovy 1.8.2
apache groovy 1.8.3
apache groovy 1.8.4
apache groovy 1.8.5
apache groovy 1.8.6
apache groovy 1.8.7
apache groovy 1.8.8
apache groovy 1.8.9
apache groovy 1.9.0
apache groovy 1.9.0
apache groovy 1.9.0
apache groovy 1.9.0
apache groovy 2.0.0
apache groovy 2.0.0
apache groovy 2.0.0
apache groovy 2.0.0
apache groovy 2.0.0
apache groovy 2.0.0
apache groovy 2.0.0
apache groovy 2.0.0
apache groovy 2.0.1
apache groovy 2.0.2
apache groovy 2.0.3
apache groovy 2.0.4
apache groovy 2.0.5
apache groovy 2.0.6
apache groovy 2.0.7
apache groovy 2.0.8
apache groovy 2.1.0
apache groovy 2.1.0
apache groovy 2.1.0
apache groovy 2.1.0
apache groovy 2.1.0
apache groovy 2.1.1
apache groovy 2.1.2
apache groovy 2.1.3
apache groovy 2.1.4
apache groovy 2.1.5
apache groovy 2.1.6
apache groovy 2.1.7
apache groovy 2.1.8
apache groovy 2.1.9
apache groovy 2.2.0
apache groovy 2.2.0
apache groovy 2.2.0
apache groovy 2.2.0
apache groovy 2.2.0
apache groovy 2.2.0
apache groovy 2.2.1
apache groovy 2.2.2
apache groovy 2.3.0
apache groovy 2.3.0
apache groovy 2.3.0
apache groovy 2.3.0
apache groovy 2.3.0
apache groovy 2.3.0
apache groovy 2.3.1
apache groovy 2.3.2
apache groovy 2.3.3
apache groovy 2.3.4
apache groovy 2.3.5
apache groovy 2.3.6
apache groovy 2.3.7
apache groovy 2.3.8
apache groovy 2.3.9
apache groovy 2.3.10
apache groovy 2.3.11
apache groovy 2.4.0
apache groovy 2.4.0
apache groovy 2.4.0
apache groovy 2.4.0
apache groovy 2.4.0
apache groovy 2.4.0
apache groovy 2.4.0
apache groovy 2.4.1
apache groovy 2.4.2
apache groovy 2.4.3
oracle health_sciences_clinical_development_center 3.1.1
oracle health_sciences_clinical_development_center 3.1.2
oracle retail_order_broker_cloud_service 4.1
oracle retail_order_broker_cloud_service 5.1
oracle retail_order_broker_cloud_service 5.2
oracle retail_order_broker_cloud_service 15.0
oracle retail_service_backbone 13.0
oracle retail_service_backbone 13.1
oracle retail_service_backbone 13.2
oracle retail_service_backbone 14.0
oracle retail_service_backbone 14.1
oracle retail_service_backbone 15.0
oracle retail_store_inventory_management 13.2
oracle retail_store_inventory_management 14.0
oracle retail_store_inventory_management 14.1
oracle webcenter_sites 11.1.1.8.0
oracle webcenter_sites 12.2.1


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "565A8A62-8F7E-4C3F-934C-F36B9A353D9B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.7.0:beta_1:*:*:*:*:*:*",
              "matchCriteriaId": "15210A74-0E69-4F28-B356-8EA7ED0C3831",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.7.0:beta_2:*:*:*:*:*:*",
              "matchCriteriaId": "1FBE9618-5A18-401C-8D74-0EAA02D31553",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.7.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "9CA686E1-6384-4F43-8165-31C490909ACE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.7.0:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "94170FFD-A756-4BFC-8900-91E0D64CE6FD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.7.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "97DB1B72-ACC3-4C82-A182-F1BD7766B01A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.7.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "DDA45976-50A3-444F-8693-734CF07D0ED6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.7.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "8082E398-371E-469E-B699-1B5AB0EEF676",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.7.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "B7B81590-6C49-48D6-A2E9-BA09B549159F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.7.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "2D3E726E-1043-4067-8AB4-02A08C52D7C5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.7.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "30E267FA-A156-4880-822E-5A34094FC26E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.7.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "789D66C8-8B94-4349-830F-D9A6D6C5FF35",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.7.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "B8AA186A-3061-49E2-996A-3405198BACB3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.7.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "4118B67D-10CA-4373-ADC5-B7C1AA0B0814",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.7.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "0A559B2D-6F1B-40C8-A8F8-DC0F272D9C05",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.7.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "607B9E80-F763-4445-8CBE-AB30F81E9F79",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "49B6C53B-12DE-499E-BF11-21E988AE69E3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.8.0:beta_1:*:*:*:*:*:*",
              "matchCriteriaId": "7DB271EE-55C6-420A-A4F3-1FCCC4A1E536",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.8.0:beta_2:*:*:*:*:*:*",
              "matchCriteriaId": "534CF3B2-1526-4939-8CA4-73C136139B37",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.8.0:beta_3:*:*:*:*:*:*",
              "matchCriteriaId": "6FE5ED10-9BE1-497C-BFF5-FB117D470868",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.8.0:beta_4:*:*:*:*:*:*",
              "matchCriteriaId": "41E75756-0D5C-497E-9C95-8F89C6CDD0A0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.8.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "76050825-9A03-462F-9035-87EDC0E32091",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.8.0:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "41313322-E506-46F2-BB0C-F0F90E9C8F66",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.8.0:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "7F9A2859-681A-43DE-8282-F7AE72EC5670",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.8.0:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "7646FEB3-83B2-4951-A3C9-863B4938FB98",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.8.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "566A91C5-672E-458D-896C-481E40F116D4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.8.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "15F6843B-12C7-4E7D-986B-0EE7098A2BE4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.8.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "86911526-4911-4EF4-A5FB-742F2F23C283",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.8.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "38620A98-0F48-4BB2-8FEA-D00796713056",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.8.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "F0EF6781-95D4-4908-A55D-888F694BF468",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.8.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "BCB846E3-8D81-44B1-8C9A-CF68E93D68ED",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.8.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "19503EAB-5637-4075-9A29-892F7395E743",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.8.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "96768F0A-E177-471F-8197-EFF56CE0FD17",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.8.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "8062ACA3-BEA2-46CC-99C7-F6AE92E4130E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "E7F78C79-0F93-4E38-972C-03DEC7CDCDD1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.9.0:beta_1:*:*:*:*:*:*",
              "matchCriteriaId": "A382D9C5-DE4F-4A0A-8D2E-D5B7CE152A9B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.9.0:beta_3:*:*:*:*:*:*",
              "matchCriteriaId": "2E1D3896-B64A-45FA-B861-775D834E8D3C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:1.9.0:beta_4:*:*:*:*:*:*",
              "matchCriteriaId": "94B67066-EDC2-4852-A092-D9E5BD3DAE2D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "34AE23A0-2A65-4E7F-869F-3A41C3F6565B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.0.0:beta_1:*:*:*:*:*:*",
              "matchCriteriaId": "5E9B8472-DB38-4EE9-83D0-C4A1DE44EB4C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.0.0:beta_2:*:*:*:*:*:*",
              "matchCriteriaId": "61F98F74-5405-4E32-B944-9FCD1D744B49",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.0.0:beta_3:*:*:*:*:*:*",
              "matchCriteriaId": "CBD11E3A-C94A-464E-8584-5841872B3E51",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.0.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "B791A7E8-5DE3-4B76-97F7-218B79E0ADE6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.0.0:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "F78F0F9F-6A17-436B-979B-0F2EF00A4860",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.0.0:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "D9DFB6E8-7A3D-4F31-AF7C-D35BA2133EE1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.0.0:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "F3E8BFC0-1EF8-4643-84BF-6513A7D36AC6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "16C0C857-A41F-429E-BD7F-16D7CC14A51C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "9ABCD368-372F-4B11-932B-25835A5F1166",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "07710AAB-E7D6-4600-AE17-A4B9411F5BD7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "2D12AB90-D1A6-4C7B-BEA1-E58D17FE97A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "37625E89-604B-4752-8A0D-0FCF18087AD9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "C5360B48-32BE-4FE4-AE6C-28EF84F47C6D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "E2BAA2EA-3C54-498A-A36B-09D6EF699E8F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.0.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "50377CE0-189E-421D-A1C7-AFC7BCBE9853",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "35E15550-2DF5-468D-AE6C-079AFB748ABA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.1.0:beta_1:*:*:*:*:*:*",
              "matchCriteriaId": "D37474B0-0EDB-4737-A190-F099AA0EC348",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.1.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "9BDBE78B-64A5-492C-A86D-1D2987C2C0B4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.1.0:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "2DC63DA9-4234-42BE-A76A-4564FA2936E5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.1.0:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "57557B0C-A098-491B-BC71-97B1F3E707E1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "51D24DF2-56FE-426D-925F-BF1D48A6C45A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "8393D1C7-BA26-4589-8CF4-4A9C6F2F9436",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "E12A9163-017E-40D5-B3B2-DCEF912F3CBD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "AE6AB4B1-47F3-4955-A5F8-46870569D2E2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "69884871-DE94-481A-B890-8385BA585B98",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.1.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "A46A0844-9BF9-4D0B-91FA-3D2B979E8F0D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.1.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "2A898188-E98A-479C-9ED8-3FD9691299CB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.1.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "1A3C399D-AE93-401C-9BA0-A5D443624CB6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.1.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "1C7E3BA4-5E49-4E09-999A-629C36C20E46",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "B4DCC641-2C37-4F21-8963-7008C5DA35B3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.2.0:beta_1:*:*:*:*:*:*",
              "matchCriteriaId": "1BC9559B-A23E-4B08-9E02-49829B2DB9AE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.2.0:beta_2:*:*:*:*:*:*",
              "matchCriteriaId": "526A1F0B-3F77-4A9C-9223-3523C3E2F0E3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.2.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "969A19E4-3AB0-4C59-BDCE-44E853A395C4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.2.0:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "72927C4F-377E-423A-A687-4036E330436D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.2.0:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "355D2577-34C8-4756-B7B4-F55B13D65ACA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "1D614336-6677-42AD-8CFB-8B61486BFB25",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "2C4F207A-48DE-4460-8C53-E34D2E1C3ADE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "4BB2F67B-CD0C-458E-A0EA-AF17EF8620BF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.3.0:beta_1:*:*:*:*:*:*",
              "matchCriteriaId": "A3688447-B686-4891-844D-327DCDC71284",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.3.0:beta_2:*:*:*:*:*:*",
              "matchCriteriaId": "6E958086-18A5-4F0B-938D-E00634BC117F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.3.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "B773B2C0-DC4D-4E9B-B484-96C1587CCF2C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.3.0:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "19F1095C-C1A3-427C-8149-BA030F2B3035",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.3.0:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "FC8AEB6E-B8EA-49A2-96A3-CD37A9B32F73",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "7C8E8367-DC45-4477-A688-B8962EFECCAA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.3.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "58A60CE0-48AB-4FE1-8999-D398CA4F6B6C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.3.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "8DDD1340-FE0B-49AA-981D-F30FDAC56F90",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.3.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "CBDDF4CF-A5EE-45AB-9283-67F2AA4630BE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.3.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "1E5698C9-D5EA-4D7B-A495-BB3179F3D7E9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.3.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "EEB8ED44-7A1E-4B78-BF54-F596F94909B5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.3.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "A08181CD-D0C4-4DF4-A0AC-50DD9330F8AA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.3.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "1531317F-0F79-47CD-9DC7-6683B23E891E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.3.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "B73D9E09-E5BE-4C75-8C20-91640FC0FA97",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.3.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "4AA55ECE-FD75-4708-BE4E-6FF599365EB7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.3.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "593D33D0-744A-4DF8-B7D8-A3B85CDF20C2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "E02C5676-5F69-4AB9-BFF3-76878DD20EBC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.4.0:beta_1:*:*:*:*:*:*",
              "matchCriteriaId": "8ABF7825-996E-4162-97BA-F3517536A43E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.4.0:beta_2:*:*:*:*:*:*",
              "matchCriteriaId": "01944C65-F293-4896-9BB7-89A550F452F9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.4.0:beta_3:*:*:*:*:*:*",
              "matchCriteriaId": "9EB1A0ED-7970-47F2-871B-700813F8E57B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.4.0:beta_4:*:*:*:*:*:*",
              "matchCriteriaId": "E7EC503A-A8EB-4C4A-ADBA-303A363F5448",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.4.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "C7ED98A3-78BD-4F5E-B35F-13CE90C7C197",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.4.0:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "030FEF45-5B99-4778-B2DB-1C340F01F8FB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "F32F6302-043E-425A-AB23-E298409B243D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.4.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "41EFA07D-645A-42BB-B909-D9F95C050F49",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:groovy:2.4.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "82B15E03-7CFA-464D-A7D3-8DAF9FAF25FD",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:health_sciences_clinical_development_center:3.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "25868228-0213-4C06-B4B0-5E504121C96A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:health_sciences_clinical_development_center:3.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "A0B53A9E-1C92-4F07-A68F-86F9EF393268",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:retail_order_broker_cloud_service:4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "5868A1C3-269C-4513-A52A-2BAA524ECA13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:retail_order_broker_cloud_service:5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "C1805C8F-2487-436C-B1DE-5EBC5687F38E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:retail_order_broker_cloud_service:5.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "AA9A5354-415D-44F3-8B59-C2177D1244A1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:retail_order_broker_cloud_service:15.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "3B9763AF-282B-40C7-B35C-4CA8C22FDC76",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:retail_service_backbone:13.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "5DE85F32-AA14-4932-A265-4163DF0331AC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:retail_service_backbone:13.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B47231C8-15DD-4ABA-86D5-CB6EEF23F587",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:retail_service_backbone:13.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "3ACA9AD3-AAFA-439C-8839-62C9977D52BF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:retail_service_backbone:14.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "69334F96-5759-4475-9931-038C98109D53",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:retail_service_backbone:14.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "378A6656-252B-4929-83EA-BC107FDFD357",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:retail_service_backbone:15.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "363395FA-C296-4B2B-9D6F-BCB8DBE6FACE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:retail_store_inventory_management:13.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "B28BA80D-9179-4A1A-A49B-5F110EF53072",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:retail_store_inventory_management:14.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "62235B8C-F221-43D5-BA95-D9127D38C28B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:retail_store_inventory_management:14.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "C1933509-1BEA-45DA-B6AF-2713B432B1F5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:webcenter_sites:11.1.1.8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "1BB4709C-6373-43CC-918C-876A6569865A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:webcenter_sites:12.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "E9A1595B-38E3-4444-A7C6-7BF310EF7E69",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en la clase MethodClosure en runtime/MethodClosure.java en Apache Groovy desde la versi\u00f3n 1.7.0 hasta la versi\u00f3n 2.4.3, permite a atacantes remotos ejecutar c\u00f3digo arbitrario y causar una denegaci\u00f3n de servicio a trav\u00e9s de un objeto serializado manipulado."
    }
  ],
  "id": "CVE-2015-3253",
  "lastModified": "2025-04-12T10:46:40.837",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2015-08-13T14:59:02.377",
  "references": [
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://groovy-lang.org/security.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Mitigation",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/132714/Apache-Groovy-2.4.3-Code-Execution.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://rhn.redhat.com/errata/RHSA-2016-0066.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securityfocus.com/archive/1/536012/100/0/threaded"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/75919"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/91787"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securitytracker.com/id/1034815"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-15-365/"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2016:1376"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2017:2486"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2017:2596"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://lists.apache.org/thread.html/rbb8e16cc5acab183124572b655bdf5fe1d5b5f477dc267352426c7ed%40%3Cnotifications.shardingsphere.apache.org%3E"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://security.gentoo.org/glsa/201610-01"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://security.netapp.com/advisory/ntap-20160623-0001/"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://groovy-lang.org/security.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mitigation",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/132714/Apache-Groovy-2.4.3-Code-Execution.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://rhn.redhat.com/errata/RHSA-2016-0066.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/536012/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/75919"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/91787"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id/1034815"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-15-365/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://access.redhat.com/errata/RHSA-2016:1376"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://access.redhat.com/errata/RHSA-2017:2486"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://access.redhat.com/errata/RHSA-2017:2596"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/rbb8e16cc5acab183124572b655bdf5fe1d5b5f477dc267352426c7ed%40%3Cnotifications.shardingsphere.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://security.gentoo.org/glsa/201610-01"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://security.netapp.com/advisory/ntap-20160623-0001/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-74"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}