GHSA-g7wm-22m6-5774
Asset Pipeline plugin for Grails vulnerable to Path Traversal
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.grails.plugins:asset-pipeline | < 3.0.4 | 3.0.4 |
Details
As written in the advisory (Markdown source, shown as plain text).
An issue was discovered in the Asset Pipeline plugin before 3.0.4 for Grails. An attacker can perform directory traversal via a crafted request when a servlet-based application is executed in Jetty, because there is a classloader vulnerability that can allow a reverse file traversal route in AssetPipelineFilter.groovy or AssetPipelineFilterCore.groovy.
References
External links from the advisory. They lead to third-party sites.