Grails is a web application framework built on the Java and Groovy ecosystems, and its vulnerability footprint, though modestly sized, clusters around the framework itself and its ecosystem of plugins such as Grails Fields, PDF Plugin, and Spring Security Core. Vulnerabilities affecting the vendor skew strongly toward critical severity and recur through weakness classes including code-integrity gaps, path traversal, cross-site scripting, and improper access control that are characteristic of dynamic web frameworks and their dependency chains. Defenders should treat Grails framework updates as high-priority, especially for internet-facing applications; live severity and exploitation counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Grails over time
Signals from CVEs in this vendor scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-41923CRITICAL Grails Spring Security Core plugin is vulnerable to privilege escalation. The vulnerability allows an attacker access to one endpoint (i.e. the targeted endpoint) using the authori | Nov 23, 2022 | 9.8 | 31 | NO | NO |
CVE-2022-35912CRITICAL In grails-databinding in Grails before 3.3.15, 4.x before 4.1.1, 5.x before 5.1.9, and 5.2.x before 5.2.1 (at least when certain Java 8 configurations are used), data binding allow | Jul 19, 2022 | 9.8 | 24 | NO | NO |
CVE-2019-12728HIGH Grails before 3.3.10 used cleartext HTTP to resolve the SDKMan notification service. NOTE: users' apps were not resolving dependencies over cleartext HTTP. | Jun 4, 2019 | 8.1 | 24 | NO | NO |
CVE-2023-46131HIGH Grails is a framework used to build web applications with the Groovy programming language. A specially crafted web request can lead to a JVM crash or denial of service. Any Grails | Dec 21, 2023 | 7.5 | 21 | NO | NO |
CVE-2017-6344MEDIUM XML External Entity (XXE) vulnerability in Grails PDF Plugin 0.6 allows remote attackers to read arbitrary files via a crafted XML document. | Feb 27, 2017 | 5.9 | 21 | NO | NO |
CVE-2018-1000529MEDIUM Grails Fields plugin version 2.2.7 contains a Cross Site Scripting (XSS) vulnerability in Using the display tag that can result in XSS . This vulnerability appears to have been fix | Jun 26, 2018 | 6.1 | 19 | NO | NO |
CVE-2014-3626HIGH The Grails Resource Plugin often has to exchange URIs for resources with other internal components. Those other components will decode any URI passed to them. To protect against di | Mar 19, 2018 | 7.5 | 19 | NO | NO |
Signals from CVEs in this vendor scope (7 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Grails.
Media articles that mention a CVE ID that affects a product developed by Grails — matched by CVE ID, not by vendor name.