CVE-2019-12728: Incorrect Resource Transfer Between Spheres in Grails
Summary
CVE-2019-12728: Incorrect Resource Transfer Between Spheres in Grails. Affects org.grails:grails-core versions < 3.3.10. Fixed in 3.3.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Grails is a web application framework built on top of the Groovy programming language. It provides a simplified and productive development experience for building Java-based web applications. The 'org.grails:grails-core' package is a core component of the Grails framework, responsible for providing essential functionality and features. However, versions of Grails before 3.3.10 were found to have a vulnerability related to incorrect resource transfer between spheres.
Vulnerability Detail
The vulnerability in Grails before 3.3.10 arises from the use of cleartext HTTP to resolve the SDKMan notification service. This means that users' applications were resolving dependencies over an insecure connection, potentially exposing sensitive information and allowing for man-in-the-middle attacks. The vulnerability has a CVSS score of 8.1, indicating a high severity level. The Common Weakness Enumeration (CWE) identifiers associated with this vulnerability are CWE-494 and CWE-669.
How To Fix
Minimum fixed version
3.3.10
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to apply the fix by upgrading to Grails version 3.3.10 or later.
Conclusion
In conclusion, the vulnerability in Grails before 3.3.10 allows for cleartext HTTP resolution of dependencies, posing a risk of exposing sensitive information and enabling man-in-the-middle attacks. To mitigate this vulnerability, it is crucial to upgrade to Grails version 3.3.10 or later and update the 'org.grails:grails-core' dependency. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.grails:grails-core →
FAQ
Grails is a web application framework built on top of the Groovy programming language. It provides a simplified and productive development experience for building Java-based web applications.
The vulnerability allows for cleartext HTTP resolution of dependencies in Grails applications, potentially exposing sensitive information and enabling man-in-the-middle attacks.
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
To fix this vulnerability, it is recommended to upgrade to Grails version 3.3.10 or later and update the 'org.grails:grails-core' dependency in your project.
There is no specific workaround mentioned for this vulnerability. The recommended approach is to apply the fix by upgrading to Grails version 3.3.10 or later.
