CVE-2022-35912: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

July 21, 2022 (updated July 22, 2022)

In grails-databinding in Grails before 3.3.15, 4.x before 4.1.1, 5.x before 5.1.9, and 5.2.x before 5.2.1 (at least when certain Java 8 configurations are used), data binding allows a remote attacker to execute code by gaining access to the class loader.

References

www.openwall.com/lists/oss-security/2022/07/20/4
github.com/advisories/GHSA-6rh6-x8ww-9h97
github.com/grails/grails-core/issues/12626
github.com/grails/grails-core/security/advisories/GHSA-6rh6-x8ww-9h97
grails.org/blog/2022-07-18-rce-vulnerability.html
nvd.nist.gov/vuln/detail/CVE-2022-35912

Code Behaviors & Features

Detect and mitigate CVE-2022-35912 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →