CVE-2015-3253

Published: Aug 13, 2015Modified: May 6, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.

Affected (120)

Products: Apache: Groovy · Oracle: Health Sciences Clinical Development Center, Retail Order Broker Cloud Service, Retail Service Backbone, Retail Store Inventory Management, Webcenter Sites

Apache

1 product

Groovy

Oracle

5 products

Health Sciences Clinical Development Center

Retail Order Broker Cloud Service

Retail Service Backbone

Retail Store Inventory Management

Webcenter Sites

Configuration A

103 vulnerable

Vulnerable Software	Affected Versions
Apache Groovy	Version 1.7.0
Apache Groovy	Version 1.7.0 beta_1
Apache Groovy	Version 1.7.0 beta_2
Apache Groovy	Version 1.7.0 rc1
Apache Groovy	Version 1.7.0 rc2
Apache Groovy	Version 1.7.10
Apache Groovy	Version 1.7.11
Apache Groovy	Version 1.7.1
Apache Groovy	Version 1.7.2
Apache Groovy	Version 1.7.3
Apache Groovy	Version 1.7.4
Apache Groovy	Version 1.7.5
Apache Groovy	Version 1.7.6
Apache Groovy	Version 1.7.7
Apache Groovy	Version 1.7.8
Apache Groovy	Version 1.7.9
Apache Groovy	Version 1.8.0
Apache Groovy	Version 1.8.0 beta_1
Apache Groovy	Version 1.8.0 beta_2
Apache Groovy	Version 1.8.0 beta_3
Apache Groovy	Version 1.8.0 beta_4
Apache Groovy	Version 1.8.0 rc1
Apache Groovy	Version 1.8.0 rc2
Apache Groovy	Version 1.8.0 rc3
Apache Groovy	Version 1.8.0 rc4
Apache Groovy	Version 1.8.1
Apache Groovy	Version 1.8.2
Apache Groovy	Version 1.8.3
Apache Groovy	Version 1.8.4
Apache Groovy	Version 1.8.5
Apache Groovy	Version 1.8.6
Apache Groovy	Version 1.8.7
Apache Groovy	Version 1.8.8
Apache Groovy	Version 1.8.9
Apache Groovy	Version 1.9.0
Apache Groovy	Version 1.9.0 beta_1
Apache Groovy	Version 1.9.0 beta_3
Apache Groovy	Version 1.9.0 beta_4
Apache Groovy	Version 2.0.0
Apache Groovy	Version 2.0.0 beta_1
Apache Groovy	Version 2.0.0 beta_2
Apache Groovy	Version 2.0.0 beta_3
Apache Groovy	Version 2.0.0 rc1
Apache Groovy	Version 2.0.0 rc2
Apache Groovy	Version 2.0.0 rc3
Apache Groovy	Version 2.0.0 rc4
Apache Groovy	Version 2.0.1
Apache Groovy	Version 2.0.2
Apache Groovy	Version 2.0.3
Apache Groovy	Version 2.0.4
Apache Groovy	Version 2.0.5
Apache Groovy	Version 2.0.6
Apache Groovy	Version 2.0.7
Apache Groovy	Version 2.0.8
Apache Groovy	Version 2.1.0
Apache Groovy	Version 2.1.0 beta_1
Apache Groovy	Version 2.1.0 rc1
Apache Groovy	Version 2.1.0 rc2
Apache Groovy	Version 2.1.0 rc3
Apache Groovy	Version 2.1.1
Apache Groovy	Version 2.1.2
Apache Groovy	Version 2.1.3
Apache Groovy	Version 2.1.4
Apache Groovy	Version 2.1.5
Apache Groovy	Version 2.1.6
Apache Groovy	Version 2.1.7
Apache Groovy	Version 2.1.8
Apache Groovy	Version 2.1.9
Apache Groovy	Version 2.2.0
Apache Groovy	Version 2.2.0 beta_1
Apache Groovy	Version 2.2.0 beta_2
Apache Groovy	Version 2.2.0 rc1
Apache Groovy	Version 2.2.0 rc2
Apache Groovy	Version 2.2.0 rc3
Apache Groovy	Version 2.2.1
Apache Groovy	Version 2.2.2
Apache Groovy	Version 2.3.0
Apache Groovy	Version 2.3.0 beta_1
Apache Groovy	Version 2.3.0 beta_2
Apache Groovy	Version 2.3.0 rc1
Apache Groovy	Version 2.3.0 rc2
Apache Groovy	Version 2.3.0 rc3
Apache Groovy	Version 2.3.10
Apache Groovy	Version 2.3.11
Apache Groovy	Version 2.3.1
Apache Groovy	Version 2.3.2
Apache Groovy	Version 2.3.3
Apache Groovy	Version 2.3.4
Apache Groovy	Version 2.3.5
Apache Groovy	Version 2.3.6
Apache Groovy	Version 2.3.7
Apache Groovy	Version 2.3.8
Apache Groovy	Version 2.3.9
Apache Groovy	Version 2.4.0
Apache Groovy	Version 2.4.0 beta_1
Apache Groovy	Version 2.4.0 beta_2
Apache Groovy	Version 2.4.0 beta_3
Apache Groovy	Version 2.4.0 beta_4
Apache Groovy	Version 2.4.0 rc1
Apache Groovy	Version 2.4.0 rc2
Apache Groovy	Version 2.4.1
Apache Groovy	Version 2.4.2
Apache Groovy	Version 2.4.3

Configuration B

15 vulnerable

Vulnerable Software	Affected Versions
Oracle Health Sciences Clinical Development Center	Version 3.1.1
Oracle Health Sciences Clinical Development Center	Version 3.1.2
Oracle Retail Order Broker Cloud Service	Version 15.0
Oracle Retail Order Broker Cloud Service	Version 4.1
Oracle Retail Order Broker Cloud Service	Version 5.1
Oracle Retail Order Broker Cloud Service	Version 5.2
Oracle Retail Service Backbone	Version 13.0
Oracle Retail Service Backbone	Version 13.1
Oracle Retail Service Backbone	Version 13.2
Oracle Retail Service Backbone	Version 14.0
Oracle Retail Service Backbone	Version 14.1
Oracle Retail Service Backbone	Version 15.0
Oracle Retail Store Inventory Management	Version 13.2
Oracle Retail Store Inventory Management	Version 14.0
Oracle Retail Store Inventory Management	Version 14.1

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Oracle Webcenter Sites	Version 11.1.1.8.0
Oracle Webcenter Sites	Version 12.2.1

Related CWEs

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

References (46)

http://groovy-lang.org/security.html

Source: secalert@redhat.com

Vendor Advisory

http://packetstormsecurity.com/files/132714/Apache-Groovy-2.4.3-Code-Execution.html

Source: secalert@redhat.com

MitigationThird Party AdvisoryVDB Entry

http://rhn.redhat.com/errata/RHSA-2016-0066.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/536012/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/75919

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/91787

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1034815

Source: secalert@redhat.com

http://www.zerodayinitiative.com/advisories/ZDI-15-365/

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2016:1376

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2017:2486

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2017:2596

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755

Source: secalert@redhat.com

https://lists.apache.org/thread.html/rbb8e16cc5acab183124572b655bdf5fe1d5b5f477dc267352426c7ed%40%3Cnotifications.shardingsphere.apache.org%3E

Source: secalert@redhat.com

https://security.gentoo.org/glsa/201610-01

Source: secalert@redhat.com

https://security.netapp.com/advisory/ntap-20160623-0001/

Source: secalert@redhat.com

https://www.oracle.com/security-alerts/cpuapr2020.html

Source: secalert@redhat.com

https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Source: secalert@redhat.com

http://groovy-lang.org/security.html