CVE-2012-1833 VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which might allow remote attackers to bypass intended access restrictions and modify arbitrary o...
MediumCVSS 5.0
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which might allow remote attackers to bypass intended access restrictions and modify arbitrary object properties via a crafted request parameter to an application.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| springsource grails | <= 1.3.7 | No fix listed |
| springsource grails | = 1.1.0 | No fix listed |
| springsource grails | = 1.1.1 | No fix listed |
| springsource grails | = 1.1.2 | No fix listed |
| springsource grails | = 1.2.0 | No fix listed |
| springsource grails | = 1.2.1 | No fix listed |
| springsource grails | = 1.2.2 | No fix listed |
| springsource grails | = 1.3.0 | No fix listed |
| springsource grails | = 1.3.1 | No fix listed |
| springsource grails | = 1.3.2 | No fix listed |
| springsource grails | = 1.3.3 | No fix listed |
| springsource grails | = 1.3.4 | No fix listed |
| springsource grails | = 1.3.5 | No fix listed |
| springsource grails | = 1.3.6 | No fix listed |
| springsource grails | = 2.0 | No fix listed |
| springsource grails | = 2.0.1 | No fix listed |
References
- 51113 third-party-advisory
- support.springsource.com exploit patch vendor-advisory
- 55763 vdb-entry