CVE-2015-3253 — Vulnerability in org.codehaus.groovy:groovy — CVE...
Improper Neutralization of Special Elements in Output Used by a Downstream Component in Apache Groovy
Summary
Advisory Timeline
- First published May 13, 2022 (1613 days ago).
- Last revised October 17, 2024 — 889 days after initial publication.
Remediation
Upgrade to the fixed version using your package manager.
<!-- Update pom.xml dependency version to 2.4.4 for org.codehaus.groovy:groovy -->
<!-- Update pom.xml dependency version to 2.4.4 for org.codehaus.groovy:groovy-all -->
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (2)
Affects 1 ecosystem: maven (2).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| org.codehaus.groovy:groovy | maven | 1.7.0, 1.7.1, 1.7.10, 1.7.11 (+95 more) | 2.4.4 |
| org.codehaus.groovy:groovy-all | maven | 1.7.0, 1.7.1, 1.7.10, 1.7.11 (+96 more) | 2.4.4 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-74
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://nvd.nist.gov/vuln/detail/CVE-2015-3253ADVISORY
- https://access.redhat.com/errata/RHSA-2016:1376WEB
- https://access.redhat.com/errata/RHSA-2017:2486WEB
- https://access.redhat.com/errata/RHSA-2017:2596WEB
- https://github.com/apache/groovyPACKAGE
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755WEB
- https://lists.apache.org/thread.html/rbb8e16cc5acab183124572b655bdf5fe1d5b5f477dc267352426c7ed@%3Cnotifications.shardingsphere.apache.org%3EWEB
- https://security.gentoo.org/glsa/201610-01WEB
- https://security.netapp.com/advisory/ntap-20160623-0001WEB
- https://www.oracle.com/security-alerts/cpuapr2020.htmlWEB
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlWEB
- https://groovy-lang.org/security.htmlWEB
- https://packetstormsecurity.com/files/132714/Apache-Groovy-2.4.3-Code-Execution.htmlWEB
- https://rhn.redhat.com/errata/RHSA-2016-0066.htmlWEB
- https://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.htmlWEB
- https://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlWEB
- https://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlWEB
- https://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.htmlWEB
- https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.htmlWEB
- https://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlWEB
- https://www.zerodayinitiative.com/advisories/ZDI-15-365WEB
Frequently Asked Questions
- What is CVE-2015-3253?
- Improper Neutralization of Special Elements in Output Used by a Downstream Component in Apache Groovy This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
- How do I check if my project is affected by CVE-2015-3253?
- CVE-2015-3253 affects org.codehaus.groovy:groovy and org.codehaus.groovy:groovy-all. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2015-3253 and 200,000+ other known vulnerabilities.
Severity & Exploitability
Exploitation is straightforward and causes maximum impact. Patch immediately.
Also Known As
Related CVEs
- CVE-2026-107726CRITICAL
Hazelcast allows arbitrary member memory access by low-privileged client
- CVE-2026-107282CRITICAL
AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
- CVE-2016-6814CRITICAL
Deserialization of Untrusted Data in Groovy
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies