CVE-2022-35912

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In grails-databinding in Grails before 3.3.15, 4.x before 4.1.1, 5.x before 5.1.9, and 5.2.x before 5.2.1 (at least when certain Java 8 configurations are used), data binding allows a remote attacker to execute code by gaining access to the class loader.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2022/07/20/4Mailing List, Third Party Advisory
https://github.com/grails/grails-core/issues/12626Issue Tracking, Patch, Third Party Advisory
https://github.com/grails/grails-core/security/advisories/GHSA-6rh6-x8ww-9h97Third Party Advisory
https://grails.org/blog/2022-07-18-rce-vulnerability.htmlVendor Advisory
http://www.openwall.com/lists/oss-security/2022/07/20/4Mailing List, Third Party Advisory
https://github.com/grails/grails-core/issues/12626Issue Tracking, Patch, Third Party Advisory
https://github.com/grails/grails-core/security/advisories/GHSA-6rh6-x8ww-9h97Third Party Advisory
https://grails.org/blog/2022-07-18-rce-vulnerability.htmlVendor Advisory

Timeline

Published: Jul 19, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-359134.3Samourai Wallet Stonewallx2 0.99.98e allows a denial of service via a P2P coinjoin. The attacker and victim must follow each other's paynym.CVE-2022-359149.8/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.CVE-2022-359155.3OpenZeppelin Contracts is a library for secure smart contract development. The target contract of an EIP-165 `supportsInterface` query can c CVE-2022-359165.3OpenZeppelin Contracts is a library for secure smart contract development. Contracts using the cross chain utilities for Arbitrum L2, `Cross CVE-2022-359175.3Solana Pay is a protocol and set of reference implementations that enable developers to incorporate decentralized payments into their apps a CVE-2022-359186.5Streamlit is a data oriented application development framework for python. Users hosting Streamlit app(s) that use custom components are vul CVE-2022-359192.7MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. In affected versions all 'admin' users aut CVE-2022-35926.5A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured sh CVE-2022-359207.5Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when using `app.static` i CVE-2022-359214.3fof/byobu is a private discussions extension for Flarum forum. Affected versions were found to not respect private discussion disablement by CVE-2022-359227.5Rust-WebSocket is a WebSocket (RFC6455) library written in Rust. In versions prior to 0.26.5 untrusted websocket connections can cause an ou CVE-2022-359237.5v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in th