CVE-2014-2857
The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 does not properly restrict access to files in the META-INF directory, which allows remote attackers to obtain sensitive information via a direct…
Does this matter?
Lower severity and a low EPSS score (1.35%). Track it; it rarely justifies an emergency change on its own.
Description
The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 does not properly restrict access to files in the META-INF directory, which allows remote attackers to obtain sensitive information via a direct request. NOTE: this issue was SPLIT from CVE-2014-0053 due to different researchers per ADT5.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 1.35% probability · 70th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- gopivotal/grails-resources · gopivotal/grails
- Source
- cve@mitre.org
References
- http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0267.html
- http://www.gopivotal.com/security/cve-2014-0053Vendor Advisory
- http://www.securityfocus.com/archive/1/531281/100/0/threaded
- http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0267.html
- http://www.gopivotal.com/security/cve-2014-0053Vendor Advisory
- http://www.securityfocus.com/archive/1/531281/100/0/threaded
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.