CVE-2012-1833

VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which might allow remote attackers to bypass intended access restrictions and modify arbitrary object properties via a crafted request parameter to an application.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://secunia.com/advisories/51113
http://support.springsource.com/security/cve-2012-1833	Exploit Patch Vendor Advisory
http://www.securityfocus.com/bid/55763

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:springsource:grails::::::::
	cpe:2.3:a:springsource:grails:1.1.0:::::::*
	cpe:2.3:a:springsource:grails:1.1.1:::::::*
	cpe:2.3:a:springsource:grails:1.1.2:::::::*
	cpe:2.3:a:springsource:grails:1.2.0:::::::*
	cpe:2.3:a:springsource:grails:1.2.1:::::::*
	cpe:2.3:a:springsource:grails:1.2.2:::::::*
	cpe:2.3:a:springsource:grails:1.3.0:::::::*
	cpe:2.3:a:springsource:grails:1.3.1:::::::*
	cpe:2.3:a:springsource:grails:1.3.2:::::::*
	cpe:2.3:a:springsource:grails:1.3.3:::::::*
	cpe:2.3:a:springsource:grails:1.3.4:::::::*
	cpe:2.3:a:springsource:grails:1.3.5:::::::*
	cpe:2.3:a:springsource:grails:1.3.6:::::::*
	cpe:2.3:a:springsource:grails:2.0:::::::*
	cpe:2.3:a:springsource:grails:2.0.1:::::::*

History

No history.

Information

Published : 2012-09-28 21:55

Updated : 2023-12-10 11:16

NVD link : CVE-2012-1833

Mitre link : CVE-2012-1833

CVE.ORG link : CVE-2012-1833

JSON object : View

Products Affected

springsource

grails

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2012-1833", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2012-09-28T21:55:01.007", "references": [{"url": "http://secunia.com/advisories/51113", "source": "cve@mitre.org"}, {"url": "http://support.springsource.com/security/cve-2012-1833", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/55763", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which might allow remote attackers to bypass intended access restrictions and modify arbitrary object properties via a crafted request parameter to an application."}, {"lang": "es", "value": "VMware SpringSource Grails antes de v1.3.8, y v2.x antes de v2.0.2, no restringe correctamente el enlace a los datos, lo que podr\u00eda permitir a atacantes remotos eludir las restricciones de acceso y modificar las propiedades de objetos de su elecci\u00f3n a trav\u00e9s de un par\u00e1metro modificado en una petici\u00f3n a la aplicaci\u00f3n."}], "lastModified": "2013-03-02T04:40:50.847", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:springsource:grails:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CB4B4EEA-6E01-4959-BCB8-F563F93AFBD6", "versionEndIncluding": "1.3.7"}, {"criteria": "cpe:2.3:a:springsource:grails:1.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "57941BFE-B83D-407F-BCD4-E5D8F1F3591C"}, {"criteria": "cpe:2.3:a:springsource:grails:1.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "370ABCD3-C65E-4846-8919-742C24CE1D4B"}, {"criteria": "cpe:2.3:a:springsource:grails:1.1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "99A577FE-66CD-4811-A6BE-697B2E49F189"}, {"criteria": "cpe:2.3:a:springsource:grails:1.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4729D1E4-B5E5-40B0-8875-A5D1F39BADB4"}, {"criteria": "cpe:2.3:a:springsource:grails:1.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4B478BFF-ECF4-42FF-9D0B-38AD1F2D310B"}, {"criteria": "cpe:2.3:a:springsource:grails:1.2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A1A56F17-3D0C-44CB-A849-5207D38C5A04"}, {"criteria": "cpe:2.3:a:springsource:grails:1.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "04CF86D4-71F4-490B-A966-DAD0FE69316D"}, {"criteria": "cpe:2.3:a:springsource:grails:1.3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "56AB86B6-BC70-4DBC-90E2-90D54F4E8E3E"}, {"criteria": "cpe:2.3:a:springsource:grails:1.3.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EE86A736-F4F8-4772-B085-C6FFB32DE81D"}, {"criteria": "cpe:2.3:a:springsource:grails:1.3.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "75E5A0A8-91CB-430D-A80E-09FDA3DF4A1A"}, {"criteria": "cpe:2.3:a:springsource:grails:1.3.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "84520A33-BA43-49CE-BF16-2918F42B9EF0"}, {"criteria": "cpe:2.3:a:springsource:grails:1.3.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "71B6BE41-F82A-44AB-9017-41C830F204C1"}, {"criteria": "cpe:2.3:a:springsource:grails:1.3.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "862CBB40-7346-489F-96C5-13EE57A37EBF"}, {"criteria": "cpe:2.3:a:springsource:grails:2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F928FB64-7693-496D-921C-E80107573DF2"}, {"criteria": "cpe:2.3:a:springsource:grails:2.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B6C20EF3-8E52-4AD9-9FCD-AFD04D8EF32A"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}