« Volver al listado

CVE-2022-35912

Estado: ModificadaCrítica (9.8)—

In grails-databinding in Grails before 3.3.15, 4.x before 4.1.1, 5.x before 5.1.9, and 5.2.x before 5.2.1 (at least when certain Java 8 configurations are used), data binding allows a remote attacker to execute code by gaining access to the class loader.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Grails — Grails

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-35912",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-07-19T16:15:08.697",
  "references": [
    {
      "url": "http://www.openwall.com/lists/oss-security/2022/07/20/4",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/grails/grails-core/issues/12626",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/grails/grails-core/security/advisories/GHSA-6rh6-x8ww-9h97",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://grails.org/blog/2022-07-18-rce-vulnerability.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2022/07/20/4",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/grails/grails-core/issues/12626",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/grails/grails-core/security/advisories/GHSA-6rh6-x8ww-9h97",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://grails.org/blog/2022-07-18-rce-vulnerability.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In grails-databinding in Grails before 3.3.15, 4.x before 4.1.1, 5.x before 5.1.9, and 5.2.x before 5.2.1 (at least when certain Java 8 configurations are used), data binding allows a remote attacker to execute code by gaining access to the class loader."
    },
    {
      "lang": "es",
      "value": "En grails-databinding en Grails versiones anteriores a 3.3.15, 4.x anteriores a 4.1.1, 5.x anteriores a 5.1.9, y 5.2.x anteriores a 5.2.1 (al menos cuando son usadas determinadas configuraciones de Java 8), la vinculación de datos permite a un atacante remoto ejecutar código al conseguir acceso al cargador de clases."
    }
  ],
  "lastModified": "2026-06-17T04:52:30.380",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:grails:grails:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B893EB58-EB51-41D4-856E-30163F4D538B",
              "versionEndExcluding": "3.3.15",
              "versionStartIncluding": "3.3.10"
            },
            {
              "criteria": "cpe:2.3:a:grails:grails:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2C24C87F-9FAE-421F-8AE1-5244ED2E1E93",
              "versionEndExcluding": "4.1.1",
              "versionStartIncluding": "4.0.0"
            },
            {
              "criteria": "cpe:2.3:a:grails:grails:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "299BB9A1-8287-4375-ADB7-862A75605377",
              "versionEndExcluding": "5.1.9",
              "versionStartIncluding": "5.0.0"
            },
            {
              "criteria": "cpe:2.3:a:grails:grails:5.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ABA45FCD-1D03-416A-B496-7058C5138EB0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}