CVE-2015-3253 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Severity

75%

Complexity

99%

Confidentiality

106%

The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.

The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.

CVSS 3.0 Base Score 9.8. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS 2.0 Base Score 7.5. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P).

Overview

First reported 9 years ago

2015-08-13 14:59:00

Last updated 5 years ago

2019-04-23 19:29:00

Affected Software

Apache Software Foundation Groovy 1.7.0

1.7.0

Apache Software Foundation Groovy 1.7.0 Beta 1

1.7.0

Apache Software Foundation Groovy 1.7.0 Beta 2

1.7.0

Apache Software Foundation Groovy 1.7.0 Release Candidate 1

1.7.0

Apache Software Foundation Groovy 1.7.0 Release Candidate 2

1.7.0

Apache Software Foundation Groovy 1.7.1

1.7.1

Apache Software Foundation Groovy 1.7.2

1.7.2

Apache Software Foundation Groovy 1.7.3

1.7.3

Apache Software Foundation Groovy 1.7.4

1.7.4

Apache Software Foundation Groovy 1.7.5

1.7.5

Apache Software Foundation Groovy 1.7.6

1.7.6

Apache Software Foundation Groovy 1.7.7

1.7.7

Apache Software Foundation Groovy 1.7.8

1.7.8

Apache Software Foundation Groovy 1.7.9

1.7.9

Apache Software Foundation Groovy 1.7.10

1.7.10

Apache Software Foundation Groovy 1.7.11

1.7.11

Apache Software Foundation Groovy 1.8.0

1.8.0

Apache Software Foundation Groovy 1.8.0 Beta 1

1.8.0

Apache Software Foundation Groovy 1.8.0 Beta 2

1.8.0

Apache Software Foundation Groovy 1.8.0 Beta 3

1.8.0

Apache Software Foundation Groovy 1.8.0 Beta 4

1.8.0

Apache Software Foundation Groovy 1.8.0 Release Candidate 1

1.8.0

Apache Software Foundation Groovy 1.8.0 Release Candidate 2

1.8.0

Apache Software Foundation Groovy 1.8.0 Release Candidate 3

1.8.0

Apache Software Foundation Groovy 1.8.0 Release Candidate 4

1.8.0

Apache Software Foundation Groovy 1.8.1

1.8.1

Apache Software Foundation Groovy 1.8.2

1.8.2

Apache Software Foundation Groovy 1.8.3

1.8.3

Apache Software Foundation Groovy 1.8.4

1.8.4

Apache Software Foundation Groovy 1.8.5

1.8.5

Apache Software Foundation Groovy 1.8.6

1.8.6

Apache Software Foundation Groovy 1.8.7

1.8.7

Apache Software Foundation Groovy 1.8.8

1.8.8

Apache Software Foundation Groovy 1.8.9

1.8.9

Apache Software Foundation Groovy 1.9.0

1.9.0

Apache Software Foundation Groovy 1.9.0 Beta 1

1.9.0

Apache Software Foundation Groovy 1.9.0 Beta 3

1.9.0

Apache Software Foundation Groovy 1.9.0 Beta 4

1.9.0

Apache Software Foundation Groovy 2.0.0

2.0.0

Apache Software Foundation Groovy 2.0.0 Beta 1

2.0.0

Apache Software Foundation Groovy 2.0.0 Beta 2

2.0.0

Apache Software Foundation Groovy 2.0.0 Beta 3

2.0.0

Apache Software Foundation Groovy 2.0.0 Release Candidate 1

2.0.0

Apache Software Foundation Groovy 2.0.0 Release Candidate 2

2.0.0

Apache Software Foundation Groovy 2.0.0 Release Candidate 3

2.0.0

Apache Software Foundation Groovy 2.0.0 Release Candidate 4

2.0.0

Apache Software Foundation Groovy 2.0.1

2.0.1

Apache Software Foundation Groovy 2.0.2

2.0.2

Apache Software Foundation Groovy 2.0.3

2.0.3

Apache Software Foundation Groovy 2.0.4

2.0.4

Apache Software Foundation Groovy 2.0.5

2.0.5

Apache Software Foundation Groovy 2.0.6

2.0.6

Apache Software Foundation Groovy 2.0.7

2.0.7

Apache Software Foundation Groovy 2.0.8

2.0.8

Apache Software Foundation Groovy 2.1.0

2.1.0

Apache Software Foundation Groovy 2.1.0 Beta 1

2.1.0

Apache Software Foundation Groovy 2.1.0 Release Candidate 1

2.1.0

Apache Software Foundation Groovy 2.1.0 Release Candidate 2

2.1.0

Apache Software Foundation Groovy 2.1.0 Release Candidate 3

2.1.0

Apache Software Foundation Groovy 2.1.1

2.1.1

Apache Software Foundation Groovy 2.1.2

2.1.2

Apache Software Foundation Groovy 2.1.3

2.1.3

Apache Software Foundation Groovy 2.1.4

2.1.4

Apache Software Foundation Groovy 2.1.5

2.1.5

Apache Software Foundation Groovy 2.1.6

2.1.6

Apache Software Foundation Groovy 2.1.7

2.1.7

Apache Software Foundation Groovy 2.1.8

2.1.8

Apache Software Foundation Groovy 2.1.9

2.1.9

Apache Software Foundation Groovy 2.2.0

2.2.0

Apache Software Foundation Groovy 2.2.0 Beta 1

2.2.0

Apache Software Foundation Groovy 2.2.0 Beta 2

2.2.0

Apache Software Foundation Groovy 2.2.0 Release Candidate 1

2.2.0

Apache Software Foundation Groovy 2.2.0 Release Candidate 2

2.2.0

Apache Software Foundation Groovy 2.2.0 Release Candidate 3

2.2.0

Apache Software Foundation Groovy 2.2.1

2.2.1

Apache Software Foundation Groovy 2.2.2

2.2.2

Apache Software Foundation Groovy 2.3.0

2.3.0

Apache Software Foundation Groovy 2.3.0 Beta 1

2.3.0

Apache Software Foundation Groovy 2.3.0 Beta 2

2.3.0

Apache Software Foundation Groovy 2.3.0 Release Candidate 1

2.3.0

Apache Software Foundation Groovy 2.3.0 Release Candidate 2

2.3.0

Apache Software Foundation Groovy 2.3.0 Release Candidate 3

2.3.0

Apache Software Foundation Groovy 2.3.1

2.3.1

Apache Software Foundation Groovy 2.3.2

2.3.2

Apache Software Foundation Groovy 2.3.3

2.3.3

Apache Software Foundation Groovy 2.3.4

2.3.4

Apache Software Foundation Groovy 2.3.5

2.3.5

Apache Software Foundation Groovy 2.3.6

2.3.6

Apache Software Foundation Groovy 2.3.7

2.3.7

Apache Software Foundation Groovy 2.3.8

2.3.8

Apache Software Foundation Groovy 2.3.9

2.3.9

Apache Software Foundation Groovy 2.3.10

2.3.10

Apache Software Foundation Groovy 2.3.11

2.3.11

Apache Software Foundation Groovy 2.4.0

2.4.0

Apache Software Foundation Groovy 2.4.0 Beta 1

2.4.0

Apache Software Foundation Groovy 2.4.0 Beta 2

2.4.0

Apache Software Foundation Groovy 2.4.0 Beta 3

2.4.0

Apache Software Foundation Groovy 2.4.0 Beta 4

2.4.0

Apache Software Foundation Groovy 2.4.0 Release Candidate 1

2.4.0

Apache Software Foundation Groovy 2.4.0 Release Candidate 2

2.4.0

Apache Software Foundation Groovy 2.4.1

2.4.1

Apache Software Foundation Groovy 2.4.2

2.4.2

Apache Software Foundation Groovy 2.4.3

2.4.3

Oracle Health Sciences Clinical Development Center 3.1.1

3.1.1

Oracle Health Sciences Clinical Development Center 3.1.2

3.1.2

Oracle Retail Order Broker Cloud Service 4.1

4.1

Oracle Retail Service Backbone 13.0

13.0

Oracle Retail Service Backbone 13.1

13.1

Oracle Retail Service Backbone 13.2

13.2

Oracle Retail Service Backbone 14.0

14.0

Oracle Retail Service Backbone 14.1

14.1

Oracle Retail Service Backbone 15.0

15.0

Oracle Retail Store Inventory Management 13.2

13.2

Oracle Retail Store Inventory Management 14.0

14.0

Oracle Retail Store Inventory Management 14.1

14.1

Oracle Webcenter Sites 11.1.1.8.0

11.1.1.8.0

Oracle Webcenter Sites 12.2.1

12.2.1

References

http://groovy-lang.org/security.html

Vendor Advisory

http://packetstormsecurity.com/files/132714/Apache-Groovy-2.4.3-Code-Execution.html

Mitigation, Third Party Advisory, VDB Entry

RHSA-2016:0066

http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html

Patch, Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

Patch, Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

20150716 [CVE-2015-3253] Apache Groovy Zero-Day Vulnerability Disclosure

75919

Third Party Advisory, VDB Entry

91787

Third Party Advisory, VDB Entry

1034815

http://www.zerodayinitiative.com/advisories/ZDI-15-365/

Third Party Advisory, VDB Entry

RHSA-2016:1376

RHSA-2017:2486

RHSA-2017:2596

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755

GLSA-201610-01

https://security.netapp.com/advisory/ntap-20160623-0001/

N/A

https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.