Vulnerabilities

 1 via 3 paths

Dependencies

 85

Source

 GitHub

Commit

 08290438

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 1
Status
  • 1
  • 0
  • 0

high severity

Improper Input Validation

  • Vulnerable module: org.glassfish:javax.el
  • Introduced through: org.grails:grails-plugin-domain-class@6.2.0 and org.grails:grails-plugin-services@6.2.0

Detailed paths

  • Introduced through: alvarosanchez/grails-spring-security-rest@alvarosanchez/grails-spring-security-rest#08290438a7ed85ba8a27c9c653715755e0a37ecb › org.grails:grails-plugin-domain-class@6.2.0 › org.grails:grails-datastore-gorm@8.1.2 › org.glassfish:javax.el@3.0.1-b12
  • Introduced through: alvarosanchez/grails-spring-security-rest@alvarosanchez/grails-spring-security-rest#08290438a7ed85ba8a27c9c653715755e0a37ecb › org.grails:grails-plugin-domain-class@6.2.0 › org.grails:grails-datastore-gorm-support@8.1.2 › org.grails:grails-datastore-gorm@8.1.2 › org.glassfish:javax.el@3.0.1-b12
  • Introduced through: alvarosanchez/grails-spring-security-rest@alvarosanchez/grails-spring-security-rest#08290438a7ed85ba8a27c9c653715755e0a37ecb › org.grails:grails-plugin-services@6.2.0 › org.grails:grails-plugin-datasource@6.2.0 › org.grails:grails-datastore-gorm@8.1.2 › org.glassfish:javax.el@3.0.1-b12

Overview

Affected versions of this package are vulnerable to Improper Input Validation. A bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.

The bug seems to be in the parser’s grammar - $ or # followed by a character that is not {, $ or # will be treated as a literal expression. The pertinent case is when the character following the $ or # chars is a backslash. The parser will then consume the backslash as part of the literal expression and will leave the character that follows it unescaped.

Note: org.glassfish:javax.el is deprecated, users can move to use org.glassfish:jakarta.el instead where this issue is first fixed in version 3.0.4.

Remediation

There is no fixed version for org.glassfish:javax.el.

References

Improper Input Validation vulnerability report