org.grails.plugins vulnerabilities

Products

• org.grails.plugins/asset-pipeline 2
• org.grails.plugins/fields 1

Latest org.grails.plugins CVEs

Newest publication first

1. CVE-2018-1000817 Asset Pipeline Grails Plugin vulnerable to Path Traversal

   Published 2018-12-20

   High·CVSS 7.5 EPSS 2.5%

   Asset Pipeline Grails Plugin Asset-pipeline plugin version Prior to 2.14.1.1, 2.15.1 and 3.0.6 contains a Incorrect Access Control vulnerability in Applications deployed in Jetty that can result in Download .class files and any arbitrary file. This attack appear to be exploitable...

2. CVE-2018-17605 Asset Pipeline plugin for Grails vulnerable to Path Traversal

   Published 2018-09-28

   High·CVSS 7.5 EPSS 2.2%

   An issue was discovered in the Asset Pipeline plugin before 3.0.4 for Grails. An attacker can perform directory traversal via a crafted request when a servlet-based application is executed in Jetty, because there is a classloader vulnerability that can allow a reverse file traver...

3. CVE-2018-1000529 Stored Cross Site Scripting in Grails Fields Plugin

   Published 2018-06-26

   Medium·CVSS 6.1 PoC

   Grails Fields plugin version 2.2.7 contains a Cross Site Scripting (XSS) vulnerability in Using the display tag that can result in XSS . This vulnerability appears to have been fixed in 2.2.8.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.