CVE-2023-46131

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Grails is a framework used to build web applications with the Groovy programming language. A specially crafted web request can lead to a JVM crash or denial of service. Any Grails framework application using Grails data binding is vulnerable. This issue has been patched in version 3.3.17, 4.1.3, 5.3.4, 6.1.0.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: Dec 21, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-461326.5Hyperledger Fabric is an open source permissioned distributed ledger framework. Combining two molecules to one another, called "cross-linkin CVE-2023-461339.1CryptoES is a cryptography algorithms library compatible with ES6 and TypeScript. Prior to version 2.1.0, CryptoES PBKDF2 is 1,000 times wea CVE-2023-461349.8D-Tale is the combination of a Flask back-end and a React front-end to view & analyze Pandas data structures. Prior to version 3.7.0, users CVE-2023-461357.5rs-stellar-strkey is a Rust lib for encode/decode of Stellar Strkeys. A panic vulnerability occurs when a specially crafted payload is used.CVE-2023-461367.5Werkzeug is a comprehensive WSGI web application library. In versions on the 3.x branch prior to 3.0.1 and on the 2.x branch prior to 2.3.8,CVE-2023-461375.3Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP p CVE-2023-461385.3JumpServer is an open source bastion host and maintenance security audit system that complies with 4A specifications. Prior to version 3.8.0 CVE-2023-461395.7KernelSU is a Kernel based root solution for Android. Starting in version 0.6.1 and prior to version 0.7.0, if a KernelSU installed device i CVE-2023-46149.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not re CVE-2023-461419.8Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote CVE-2023-461428.8A incorrect permission assignment for critical resource vulnerability in PLCnext products allows an remote attacker with low privileges to g CVE-2023-461437.5Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to mod