Find, fix and prevent vulnerabilities in your code.
high severity
- Vulnerable module: org.glassfish:javax.el
- Introduced through: org.grails:grails-plugin-domain-class@6.2.0 and org.grails:grails-plugin-services@6.2.0
Detailed paths
-
Introduced through: alvarosanchez/grails-spring-security-rest@alvarosanchez/grails-spring-security-rest#08290438a7ed85ba8a27c9c653715755e0a37ecb › org.grails:grails-plugin-domain-class@6.2.0 › org.grails:grails-datastore-gorm@8.1.2 › org.glassfish:javax.el@3.0.1-b12
-
Introduced through: alvarosanchez/grails-spring-security-rest@alvarosanchez/grails-spring-security-rest#08290438a7ed85ba8a27c9c653715755e0a37ecb › org.grails:grails-plugin-domain-class@6.2.0 › org.grails:grails-datastore-gorm-support@8.1.2 › org.grails:grails-datastore-gorm@8.1.2 › org.glassfish:javax.el@3.0.1-b12
-
Introduced through: alvarosanchez/grails-spring-security-rest@alvarosanchez/grails-spring-security-rest#08290438a7ed85ba8a27c9c653715755e0a37ecb › org.grails:grails-plugin-services@6.2.0 › org.grails:grails-plugin-datasource@6.2.0 › org.grails:grails-datastore-gorm@8.1.2 › org.glassfish:javax.el@3.0.1-b12
Overview
Affected versions of this package are vulnerable to Improper Input Validation. A bug in the ELParserTokenManager
enables invalid EL expressions to be evaluated as if they were valid.
The bug seems to be in the parser’s grammar - $
or #
followed by a character that is not {
, $
or #
will be treated as a literal expression. The pertinent case is when the character following the $
or #
chars is a backslash. The parser will then consume the backslash as part of the literal expression and will leave the character that follows it unescaped.
Note:
org.glassfish:javax.el
is deprecated, users can move to use org.glassfish:jakarta.el
instead where this issue is first fixed in version 3.0.4
.
Remediation
There is no fixed version for org.glassfish:javax.el
.
References
medium severity
new
- Vulnerable module: org.springframework:spring-expression
- Introduced through: org.grails:grails-core@6.2.0, org.grails:grails-plugin-services@6.2.0 and others
Detailed paths
-
Introduced through: alvarosanchez/grails-spring-security-rest@alvarosanchez/grails-spring-security-rest#08290438a7ed85ba8a27c9c653715755e0a37ecb › org.grails:grails-core@6.2.0 › org.springframework:spring-context@5.3.33 › org.springframework:spring-expression@5.3.33
-
Introduced through: alvarosanchez/grails-spring-security-rest@alvarosanchez/grails-spring-security-rest#08290438a7ed85ba8a27c9c653715755e0a37ecb › org.grails:grails-plugin-services@6.2.0 › org.grails:grails-core@6.2.0 › org.springframework:spring-context@5.3.33 › org.springframework:spring-expression@5.3.33
-
Introduced through: alvarosanchez/grails-spring-security-rest@alvarosanchez/grails-spring-security-rest#08290438a7ed85ba8a27c9c653715755e0a37ecb › org.springframework.boot:spring-boot-autoconfigure@3.3.2 › org.springframework.boot:spring-boot@3.3.2 › org.springframework:spring-context@5.3.33 › org.springframework:spring-expression@5.3.33Remediation: Upgrade to org.springframework.boot:spring-boot-autoconfigure@3.3.2.
Overview
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling. Note: An application is vulnerable when the following is true:
The application evaluates user-supplied SpEL expressions.
Workaround
Evaluation of user-supplied SpEL expressions should be avoided when possible; otherwise, user-supplied SpEL expressions should be evaluated with a SimpleEvaluationContext
in read-only mode. No other steps are necessary.
Remediation
Upgrade org.springframework:spring-expression
to version 5.3.39 or higher.