CVE-2021-23259CWE-913

Groovy Sandbox Bypass

Medium · published December 2, 2021

CVSS v3.1
4.2
EPSS
1%
Percentile
53.6
In the wild
Unconfirmed
What it is

Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage. The groovy script does not have security restrictions, which will cause attackers to execute arbitrary commands remotely(RCE).

The record
Technical detail
CVSS v3.1
4.2 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00727 · 53.6th percentile
Weakness
CWE-913 · Improper Control of Dynamically-Managed Code Resources
Published
2021-12-02T15:40Z
EPSS history
Timeline
  • 02 DEC 15:40Z
    Groovy Sandbox Bypass
    cvelistv5