high7.5
CVE-2018-17605
An issue was discovered in the Asset Pipeline plugin before 3.0.4 for Grails.
Impact
An issue was discovered in the Asset Pipeline plugin before 3.0.4 for Grails. An attacker can perform directory traversal via a crafted request when a servlet-based application is executed in Jetty, because there is a classloader vulnerability that can allow a reverse file traversal route in AssetPipelineFilter.groovy or AssetPipelineFilterCore.groovy.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Asset Pipeline Project | Asset-Pipeline | before 3.0.4 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/bertramdev/asset-pipeline/commit/a29533c52e4b60e244082433e116d2a038d01017
- https://github.com/grails/grails-core/issues/11068
- https://github.com/bertramdev/asset-pipeline/commit/a29533c52e4b60e244082433e116d2a038d01017
- https://github.com/grails/grails-core/issues/11068