CVE-2016-6521

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Cross-site request forgery (CSRF) vulnerability in Grails console (aka Grails Debug Console and Grails Web Console) 2.0.7, 1.5.10, and earlier allows remote attackers to hijack the authentication of users for requests that execute arbitrary Groovy code via unspecified vectors.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2016/08/02/11Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/08/02/2Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/08/03/9Third Party Advisory
http://www.securityfocus.com/bid/92267
https://github.com/sheehan/grails-console/issues/54Exploit, Vendor Advisory
https://github.com/sheehan/grails-console/issues/55Patch, Vendor Advisory
http://www.openwall.com/lists/oss-security/2016/08/02/11Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/08/02/2Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/08/03/9Third Party Advisory
http://www.securityfocus.com/bid/92267
https://github.com/sheehan/grails-console/issues/54Exploit, Vendor Advisory
https://github.com/sheehan/grails-console/issues/55Patch, Vendor Advisory

Timeline

Published: Jan 23, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-65225.5Integer overflow in the uvm_map_isavail function in uvm/uvm_map.c in OpenBSD 5.9 allows local users to cause a denial of service (kernel pan CVE-2016-65236.1Multiple cross-site scripting (XSS) vulnerabilities in the media manager in Dotclear before 2.10 allow remote attackers to inject arbitrary CVE-2016-65259.8Heap-based buffer overflow in the pdf_load_mesh_params function in pdf/pdf-shade.c in MuPDF allows remote attackers to cause a denial of ser CVE-2016-65267.8The SpamCall Activity component in Telecom application on Samsung Note device L(5.0/5.1) and M(6.0) allows attackers to cause a denial of se CVE-2016-65277.8The SmartCall Activity component in Telecom application on Samsung Note device L(5.0/5.1) and M(6.0) allows attackers to cause a denial of s CVE-2016-65309.8Dentsply Sirona (formerly Schick) CDR Dicom 5 and earlier has default passwords for the sa and cdr accounts, which allows remote attackers t CVE-2016-65319.8Open Dental 16.1 and earlier has a hardcoded MySQL root password, which allows remote attackers to obtain administrative access by leveragin CVE-2016-65329.8DEXIS Imaging Suite 10 has a hardcoded password for the sa account, which allows remote attackers to obtain administrative access by enterin CVE-2016-65347.5Opmantek NMIS before 4.3.7c has command injection via man, finger, ping, trace, and nslookup in the tools.pl CGI script. Versions before 8.5 CVE-2016-65359.8AVer Information EH6108H+ devices with firmware X9.03.24.00.07l have hardcoded accounts, which allows remote attackers to obtain root access CVE-2016-65369.8The /setup URI on AVer Information EH6108H+ devices with firmware X9.03.24.00.07l allows remote attackers to bypass intended page-access res CVE-2016-65377.5AVer Information EH6108H+ devices with firmware X9.03.24.00.07l store passwords in a cleartext base64 format and require cleartext credentia