Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-41904 State: PUBLISHED Published: 2022-11-11T00:00:00.000Z Last Updated: 2025-04-23T16:37:58.199Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: vector-im Products: element-ios Problem Types: CWE-357 Description: Element iOS is an iOS Matrix client provided by Element. It is based on MatrixSDK. Prior to version 1.9.7, events encrypted using Megolm for which trust could not be established did not get decorated accordingly (with warning shields). Therefore a malicious homeserver could inject messages into the room without the user being alerted that the messages were not sent by a verified group member, even if the user has previously verifie
e user being alerted that the messages were not sent by a verified group member, even if the user has previously verified all group members. This issue has been patched in Element iOS 1.9.7. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/vector-im/element-ios/security/advisories/GHSA-fm8m-99j7-323g - https://github.com/vector-im/element-ios/releases/tag/v1.9.7
CVE ID: CVE-2022-41905 State: PUBLISHED Published: 2022-11-11T00:00:00.000Z Last Updated: 2025-04-23T16:37:51.851Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: mar10 Products: wsgidav Problem Types: CWE-79 Description: WsgiDAV is a generic and extendable WebDAV server based on WSGI. Implementations using this library with directory browsing enabled may be susceptible to Cross Site Scripting (XSS) attacks. This issue has been patched, users can upgrade to version 4.1.0. As a workaround, set `dir_browser.enable = False` in the configuration. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mar10/wsgi
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mar10/wsgidav/security/advisories/GHSA-xx6g-jj35-pxjv - https://github.com/mar10/wsgidav/commit/e9606ab0f42f4c1a6611bc3c52de299b0aba7726
CVE ID: CVE-2022-41906 State: PUBLISHED Published: 2022-11-11T00:00:00.000Z Last Updated: 2025-04-23T16:37:45.490Z Severity: HIGH (CVSS 7.7 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: opensearch-project Products: notifications Problem Types: CWE-918 Description: OpenSearch Notifications is a notifications plugin for OpenSearch that enables other plugins to send notifications via Email, Slack, Amazon Chime, Custom web-hook etc channels. A potential SSRF issue in OpenSearch Notifications Plugin starting in 2.0.0 and prior to 2.2.1 could allow an existing privileged user to enumerate listening services or interact with configured resources via HTTP requests exceeding the Notification
user to enumerate listening services or interact with configured resources via HTTP requests exceeding the Notification plugin's intended scope. OpenSearch 2.2.1+ contains the fix for this issue. There are currently no recommended workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/opensearch-project/notifications/security/advisories/GHSA-pfc4-3436-jgrw - https://github.com/opensearch-project/notifications/pull/496 - https://github.com/opensearch-project/notifications/pull/507
CVE ID: CVE-2022-41907 State: PUBLISHED Published: 2022-11-18T00:00:00.000Z Last Updated: 2025-04-22T16:03:11.875Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-131 Description: TensorFlow is an open source platform for machine learning. When `tf.raw_ops.ResizeNearestNeighborGrad` is given a large `size` input, it overflows. We have patched the issue in GitHub commit 00c821af032ba9e5f5fa3fe14690c8d28a657624. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range. Additional A
on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-368v-7v32-52fx - https://github.com/tensorflow/tensorflow/commit/00c821af032ba9e5f5fa3fe14690c8d28a657624 - https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/image/resize_nearest_neighbor_op.cc
CVE ID: CVE-2022-41908 State: PUBLISHED Published: 2022-11-18T00:00:00.000Z Last Updated: 2025-04-22T16:02:59.540Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-20 Description: TensorFlow is an open source platform for machine learning. An input `token` that is not a UTF-8 bytestring will trigger a `CHECK` fail in `tf.raw_ops.PyFunc`. We have patched the issue in GitHub commit 9f03a9d3bafe902c1e6beb105b2f24172f238645. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range. Ad
is commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tensorflow/tensorflow/blob/master/tensorflow/python/lib/core/py_func.cc - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-mv77-9g28-cwg3 - https://github.com/tensorflow/tensorflow/commit/9f03a9d3bafe902c1e6beb105b2f24172f238645
CVE ID: CVE-2022-41909 State: PUBLISHED Published: 2022-11-18T00:00:00.000Z Last Updated: 2025-04-22T16:02:49.290Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-20 Description: TensorFlow is an open source platform for machine learning. An input `encoded` that is not a valid `CompositeTensorVariant` tensor will trigger a segfault in `tf.raw_ops.CompositeTensorVariantToComponents`. We have patched the issue in GitHub commits bf594d08d377dc6a3354d9fdb494b32d45f91971 and 660ce5a89eb6766834bdc303d2ab3902aef99d3d. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.1
c303d2ab3902aef99d3d. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-rjx6-v474-2ch9 - https://github.com/tensorflow/tensorflow/commit/660ce5a89eb6766834bdc303d2ab3902aef99d3d - https://github.com/tensorflow/tensorflow/commit/bf594d08d377dc6a3354d9fdb494b32d45f91971 - https://github.com/tensorflow/tensorflow/blob/master/tensorflow/python/lib/core/py_func.cc
CVE ID: CVE-2022-41910 State: PUBLISHED Published: 2022-12-06T00:00:00.000Z Last Updated: 2025-04-23T16:32:26.257Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-125 Description: TensorFlow is an open source platform for machine learning. The function MakeGrapplerFunctionItem takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered. We have patched the issue in GitHub commit a65411a1d69edfb16b25907ffb8f73556ce36bb7. The fix will be included in TensorFlow 2.11.0. We will also
e in GitHub commit a65411a1d69edfb16b25907ffb8f73556ce36bb7. The fix will be included in TensorFlow 2.11.0. We will also cherrypick this commit on TensorFlow 2.8.4, 2.9.3, and 2.10.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-frqp-wp83-qggv - https://github.com/tensorflow/tensorflow/commit/a65411a1d69edfb16b25907ffb8f73556ce36bb7 - https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/grappler/utils/functions.cc#L221
CVE ID: CVE-2022-41911 State: PUBLISHED Published: 2022-11-18T00:00:00.000Z Last Updated: 2025-04-23T16:36:49.951Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-704 Description: TensorFlow is an open source platform for machine learning. When printing a tensor, we get it's data as a `const char*` array (since that's the underlying storage) and then we typecast it to the element type. However, conversions from `char` to `bool` are undefined if the `char` is not `0` or `1`, so sanitizers/fuzzers will crash. The issue has been patched in GitHub commit `1be74370327`. The fix will be included in TensorFlow 2.11
zzers will crash. The issue has been patched in GitHub commit `1be74370327`. The fix will be included in TensorFlow 2.11.0. We will also cherrypick this commit on TensorFlow 2.10.1, TensorFlow 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-pf36-r9c6-h97j - https://github.com/tensorflow/tensorflow/commit/1be743703279782a357adbf9b77dcb994fe8b508 - https://github.com/tensorflow/tensorflow/blob/807cae8a807960fd7ac2313cde73a11fc15e7942/tensorflow/core/framework/tensor.cc#L1200-L1227
CVE ID: CVE-2022-41912 State: PUBLISHED Published: 2022-11-28T00:00:00.000Z Last Updated: 2025-04-23T16:34:38.036Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: crewjam Products: saml Problem Types: CWE-287 Description: The crewjam/saml go library prior to version 0.4.9 is vulnerable to an authentication bypass when processing SAML responses containing multiple Assertion elements. This issue has been corrected in version 0.4.9. There are no workarounds other than upgrading to a fixed version. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/crewjam/saml/security/advisories/GHSA-j2jp-wvqg-wc2g -
ainer: - CISA ADP Vulnrichment: References: - https://github.com/crewjam/saml/security/advisories/GHSA-j2jp-wvqg-wc2g - https://github.com/crewjam/saml/commit/aee3fb1edeeaf1088fcb458727e0fd863d277f8b - http://packetstormsecurity.com/files/170356/crewjam-saml-Signature-Bypass.html
CVE ID: CVE-2022-41913 State: PUBLISHED Published: 2022-11-14T00:00:00.000Z Last Updated: 2025-04-23T16:37:33.117Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: discourse Products: discourse-calendar Problem Types: CWE-200 Description: Discourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic. Members of private groups or public groups with private members can be listed by users, who can create and edit post events. This vulnerability only affects sites which have discourse post events enabled. This issue has been patched in commit `ca5ae3e7e` which will be included
ites which have discourse post events enabled. This issue has been patched in commit `ca5ae3e7e` which will be included in future releases. Users unable to upgrade should disable the `discourse_post_event_enabled` setting to fully mitigate the issue. Also, it's possible to prevent regular users from using this vulnerability by removing all groups from the `discourse_post_event_allowed_on_groups` but note that moderators will still be able to use it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse-calendar/security/advisories/GHSA-jh96-w279-g7r9 - https://github.com/discourse/discourse-calendar/commit/ca5ae3e7e0c
se-calendar/security/advisories/GHSA-jh96-w279-g7r9 - https://github.com/discourse/discourse-calendar/commit/ca5ae3e7e0c2b32af5ca4ec69c95e95b2ecef2e9
CVE ID: CVE-2022-41914 State: PUBLISHED Published: 2022-11-16T00:00:00.000Z Last Updated: 2025-04-23T16:36:55.819Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: zulip Products: zulip Problem Types: CWE-200 Description: Zulip is an open-source team collaboration tool. For organizations with System for Cross-domain Identity Management(SCIM) account management enabled, Zulip Server 5.0 through 5.6 checked the SCIM bearer token using a comparator that did not run in constant time. Therefore, it might theoretically be possible for an attacker to infer the value of the token by performing a sophisticated timing analysis on a large number of failing requests. If suc
infer the value of the token by performing a sophisticated timing analysis on a large number of failing requests. If successful, this would allow the attacker to impersonate the SCIM client for its abilities to read and update user accounts in the Zulip organization. Organizations where SCIM account management has not been enabled are not affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zulip/zulip/security/advisories/GHSA-q5gx-377v-w76f - https://github.com/zulip/zulip/commit/59edbfa4113d140d3e20126bc65f4d67b2a8ffe5
CVE ID: CVE-2022-41915 State: PUBLISHED Published: 2022-12-13T00:00:00.000Z Last Updated: 2025-04-22T15:57:32.870Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: netty Products: netty Problem Types: CWE-436, CWE-113 Description: Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling `DefaultHttpHeadesr.set` with an _iterator_ of values, header value validation was not performed, allowing malicious header values in the iterator to perform HTTP Response Splitting. This issue has been patched in version 4.1.86.Final. Integrators can work around the issue by changing
ponse Splitting. This issue has been patched in version 4.1.86.Final. Integrators can work around the issue by changing the `DefaultHttpHeaders.set(CharSequence, Iterator<?>)` call, into a `remove()` call, and call `add()` in a loop over the iterator of values. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/netty/netty/security/advisories/GHSA-hh82-3pmq-7frp - https://github.com/netty/netty/issues/13084 - https://github.com/netty/netty/pull/12760 - https://github.com/netty/netty/commit/fe18adff1c2b333acb135ab779a3b9ba3295a1c4 - https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html - https://www.debian.org/security/202
3b9ba3295a1c4 - https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html - https://www.debian.org/security/2023/dsa-5316 - https://security.netapp.com/advisory/ntap-20230113-0004/
CVE ID: CVE-2022-41916 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-23T16:37:26.786Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: heimdal Products: heimdal Problem Types: CWE-193 Description: Heimdal is an implementation of ASN.1/DER, PKIX, and Kerberos. Versions prior to 7.7.1 are vulnerable to a denial of service vulnerability in Heimdal's PKI certificate validation library, affecting the KDC (via PKINIT) and kinit (via PKINIT), as well as any third-party applications using Heimdal's libhx509. Users should upgrade to Heimdal 7.7.1 or 7.8. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program
upgrade to Heimdal 7.7.1 or 7.8. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/heimdal/heimdal/security/advisories/GHSA-mgqr-gvh6-23cx - https://www.debian.org/security/2022/dsa-5287 - https://lists.debian.org/debian-lts-announce/2022/11/msg00034.html - https://security.netapp.com/advisory/ntap-20230216-0008/ - https://security.gentoo.org/glsa/202310-06
CVE ID: CVE-2022-41917 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-23T16:37:20.811Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: opensearch-project Products: OpenSearch Problem Types: CWE-200 Description: OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. OpenSearch allows users to specify a local file when defining text analyzers to process data for text analysis. An issue in the implementation of this feature allows certain specially crafted queries to return a response containing the first line of text from arbitrary files. The list of potentially impacted files is limited to text files with r
ning the first line of text from arbitrary files. The list of potentially impacted files is limited to text files with read permissions allowed in the Java Security Manager policy configuration. OpenSearch version 1.3.7 and 2.4.0 contain a fix for this issue. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/opensearch-project/OpenSearch/security/advisories/GHSA-w3rx-m34v-wrqx - https://github.com/opensearch-project/OpenSearch/commit/6d20423f5920745463b1abc5f1daf6a786c41aa0
CVE ID: CVE-2022-41918 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-23T16:37:15.154Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: opensearch-project Products: security Problem Types: CWE-863, CWE-612 Description: OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. There is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the indices that back data streams potentially leading to incorrect access authorization. OpenSearch 1.3.7 and 2.4.0 contain a fix for this issue. Users ar
potentially leading to incorrect access authorization. OpenSearch 1.3.7 and 2.4.0 contain a fix for this issue. Users are advised to update. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/opensearch-project/security/security/advisories/GHSA-wmx7-x4jp-9jgg - https://github.com/opensearch-project/security/commit/f7cc569c9d3fa5d5432c76c854eed280d45ce6f4
CVE ID: CVE-2022-41919 State: PUBLISHED Published: 2022-11-22T00:00:00.000Z Last Updated: 2025-04-23T16:36:24.268Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: fastify Products: fastify Problem Types: CWE-352 Description: Fastify is a web framework with minimal overhead and plugin architecture. The attacker can use the incorrect `Content-Type` to bypass the `Pre-Flight` checking of `fetch`. `fetch()` requests with Content-Type’s essence as "application/x-www-form-urlencoded", "multipart/form-data", or "text/plain", could potentially be used to invoke routes that only accepts `application/json` content type, thus bypassing any CORS protection, and therefor
sed to invoke routes that only accepts `application/json` content type, thus bypassing any CORS protection, and therefore they could lead to a Cross-Site Request Forgery attack. This issue has been patched in version 4.10.2 and 3.29.4. As a workaround, implement Cross-Site Request Forgery protection using `@fastify/csrf'. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/fastify/fastify/security/advisories/GHSA-3fjj-p79j-c9hh - https://github.com/fastify/fastify/commit/62dde76f1f7aca76e38625fe8d983761f26e6fc9 - https://www.npmjs.com/package/%40fastify/csrf
CVE ID: CVE-2022-41920 State: PUBLISHED Published: 2022-11-17T00:00:00.000Z Last Updated: 2025-04-22T16:07:20.445Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: duke-git Products: lancet Problem Types: CWE-22 Description: Lancet is a general utility library for the go programming language. Affected versions are subject to a ZipSlip issue when using the fileutil package to unzip files. This issue has been addressed and a fix will be included in versions 2.1.10 and 1.3.4. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/duk
issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/duke-git/lancet/security/advisories/GHSA-pp3f-xrw5-q5j4 - https://github.com/duke-git/lancet/issues/62 - https://github.com/duke-git/lancet/commit/f133b32faa05eb93e66175d01827afa4b7094572 - https://github.com/duke-git/lancet/commit/f869a0a67098e92d24ddd913e188b32404fa72c9
CVE ID: CVE-2022-41921 State: PUBLISHED Published: 2022-11-28T00:00:00.000Z Last Updated: 2025-04-23T16:34:31.783Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: discourse Products: discourse Problem Types: CWE-20 Description: Discourse is an open-source discussion platform. Prior to version 2.9.0.beta13, users can post chat messages of an unlimited length, which can cause a denial of service for other users when posting huge amounts of text. Users should upgrade to version 2.9.0.beta13, where a limit has been introduced. No known workarounds are available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github
are available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-mfh7-6cv6-qccc - https://github.com/discourse/discourse/commit/3de765c89524a526ce611e11468d758a471a933f
CVE ID: CVE-2022-41922 State: PUBLISHED Published: 2022-11-23T00:00:00.000Z Last Updated: 2025-04-23T16:35:42.955Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: yiisoft Products: yii Problem Types: CWE-502 Description: `yiisoft/yii` before version 1.1.27 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. This has been patched in 1.1.27. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/yiisoft/yii/security/advisories/GHSA-442f-wcwq-fpcf - https://github.com/yiisoft/yii/commit/ed67b7cc57216557c5c595c6650cdd2d3aa41c52
CVE ID: CVE-2022-41923 State: PUBLISHED Published: 2022-11-23T00:00:00.000Z Last Updated: 2025-04-23T16:35:37.187Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: grails Products: grails-spring-security-core Problem Types: CWE-269 Description: Grails Spring Security Core plugin is vulnerable to privilege escalation. The vulnerability allows an attacker access to one endpoint (i.e. the targeted endpoint) using the authorization requirements of a different endpoint (i.e. the donor endpoint). In some Grails framework applications, access to the targeted endpoint will be granted based on meeting the authorization requirements of the donor endpoint, which can r
the targeted endpoint will be granted based on meeting the authorization requirements of the donor endpoint, which can result in a privilege escalation attack. This vulnerability has been patched in grails-spring-security-core versions 3.3.2, 4.0.5 and 5.1.1. Impacted Applications: Grails Spring Security Core plugin versions: 1.x 2.x >=3.0.0 <3.3.2 >=4.0.0 <4.0.5 >=5.0.0 <5.1.1 We strongly suggest that all Grails framework applications using the Grails Spring Security Core plugin be updated to a patched release of the plugin. Workarounds: Users should create a subclass extending one of the following classes from the `grails.plugin.springsecurity.web.access.intercept` package, depending on th