apache/groovy: The latest CVE Vulnerabilities and Exploits for Penetration Test
apache/groovy Vulnerability Summary
- Vendor name: apache
- Product name: groovy
- Total vulnerabilities: 4 (as 2023-05-04)
apache/groovy Vulnerability List
CVE-2020-17521: Apache Groovy provides extension methods to aid with creating temporary directories. Prior to…
Published: 2020-12-07T20:15:00 Last Modified: 2022-02-07T16:15:00
Summary
Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy’s implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.
Scores
- Impact Score: 2.9
- Exploitability Score: 3.9
- CVSS: 2.1
- CVSS Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Impact
- Availability: NONE
- Confidentiality: PARTIAL
- Integrity: NONE
Access
- Authentication: NONE
- Complexity: LOW
- Vector: LOCAL
Currently, there is no code for exploiting the CVE-2020-17521 vulnerability.
References
- https://groovy-lang.org/security.html#CVE-2020-17521
- https://lists.apache.org/thread.html/ra9dab34bf8625511f23692ad0fcee2725f782e9aad6c5cdff6cf4465@%3Cnotifications.groovy.apache.org%3E
- https://security.netapp.com/advisory/ntap-20201218-0006/
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://lists.apache.org/thread.html/rea63a4666ba245d2892471307772a2d8ce0f0741f341d6576625c1b3@%3Cdev.atlas.apache.org%3E
- https://lists.apache.org/thread.html/r4b2f13c302eec98838ff7475253091fb9b75bc1038016ba00ebf6c08@%3Cdev.atlas.apache.org%3E
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
See also: All popular products CVE Vulnerabilities of apache
CVE-2016-6814: When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache…
Published: 2018-01-18T18:29:00 Last Modified: 2020-07-15T03:15:00
Summary
When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects were subject to this vulnerability.
Common Weakness Enumeration (CWE): CWE-502: Deserialization of Untrusted Data
CWE Description: The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Scores
- Impact Score: 6.4
- Exploitability Score: 10.0
- CVSS: 7.5
- CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Impact
- Availability: PARTIAL
- Confidentiality: PARTIAL
- Integrity: PARTIAL
Access
- Authentication: NONE
- Complexity: LOW
- Vector: NETWORK
Currently, there is no code for exploiting the CVE-2016-6814 vulnerability.
References
- http://mail-archives.apache.org/mod_mbox/www-announce/201701.mbox/%3CCADRx3PMZ2hBCGDTY35zYXFGaDnjAs0tc5-upaVs6QN2sYUejyA%40mail.gmail.com%3E
- https://access.redhat.com/errata/RHSA-2017:2596
- https://access.redhat.com/errata/RHSA-2017:2486
- https://access.redhat.com/errata/RHSA-2017:0868
- http://www.securitytracker.com/id/1039600
- http://www.securityfocus.com/bid/95429
- http://rhn.redhat.com/errata/RHSA-2017-0272.html
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://security.gentoo.org/glsa/202003-01
- https://www.oracle.com/security-alerts/cpujul2020.html
See also: All popular products CVE Vulnerabilities of apache
CVE-2016-6497: main/java/org/apache/directory/groovyldap/LDAP.java in the Groovy LDAP API in Apache allows…
Published: 2017-01-18T22:59:00 Last Modified: 2020-05-28T15:59:00
Summary
main/java/org/apache/directory/groovyldap/LDAP.java in the Groovy LDAP API in Apache allows attackers to conduct LDAP entry poisoning attacks by leveraging setting returnObjFlag to true for all search methods.
Common Weakness Enumeration (CWE): CWE-254: 7PK - Security Features
CWE Description: Software security is not security software. Here we’re concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.
Scores
- Impact Score: 2.9
- Exploitability Score: 10.0
- CVSS: 5.0
- CVSS Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Impact
- Availability: NONE
- Confidentiality: NONE
- Integrity: PARTIAL
Access
- Authentication: NONE
- Complexity: LOW
- Vector: NETWORK
Currently, there is no code for exploiting the CVE-2016-6497 vulnerability.
References
- https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf
- https://mail-archives.apache.org/mod_mbox/directory-users/201610.mbox/%3Cb7d7e909-a8ed-1ab4-c853-4078c1e7624a%40stefan-seelmann.de%3E
- http://svn.apache.org/viewvc/directory/sandbox/szoerner/groovyldap/src/main/java/org/apache/directory/groovyldap/LDAP.java?r1=1765362&r2=1765361&pathrev=1765362&view=patch
- http://www.securityfocus.com/bid/95929
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
See also: All popular products CVE Vulnerabilities of apache
CVE-2015-3253: The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows…
Published: 2015-08-13T14:59:00 Last Modified: 2020-06-24T05:15:00
Summary
The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.
Common Weakness Enumeration (CWE): CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’)
CWE Description: The software constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Scores
- Impact Score: 6.4
- Exploitability Score: 10.0
- CVSS: 7.5
- CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Impact
- Availability: PARTIAL
- Confidentiality: PARTIAL
- Integrity: PARTIAL
Access
- Authentication: NONE
- Complexity: LOW
- Vector: NETWORK
Currently, there is no code for exploiting the CVE-2015-3253 vulnerability.
References
- http://packetstormsecurity.com/files/132714/Apache-Groovy-2.4.3-Code-Execution.html
- http://www.securityfocus.com/bid/75919
- http://groovy-lang.org/security.html
- http://www.zerodayinitiative.com/advisories/ZDI-15-365/
- http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- http://www.securityfocus.com/bid/91787
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755
- http://rhn.redhat.com/errata/RHSA-2016-0066.html
- https://security.gentoo.org/glsa/201610-01
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
- http://www.securitytracker.com/id/1034815
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- https://security.netapp.com/advisory/ntap-20160623-0001/
- https://access.redhat.com/errata/RHSA-2017:2596
- https://access.redhat.com/errata/RHSA-2017:2486
- https://access.redhat.com/errata/RHSA-2016:1376
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- http://www.securityfocus.com/archive/1/536012/100/0/threaded
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://lists.apache.org/thread.html/rbb8e16cc5acab183124572b655bdf5fe1d5b5f477dc267352426c7ed@%3Cnotifications.shardingsphere.apache.org%3E
See also: All popular products CVE Vulnerabilities of apache