GHSA-q25j-gcmv-5qpp

Stored Cross Site Scripting in Grails Fields Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-1000529

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.grails.plugins:fields	< 2.2.8	2.2.8
Maven	org.grails:grails-core	< 3.3.6	3.3.6

Details

As written in the advisory (Markdown source, shown as plain text).

Grails Fields plugin version 2.2.7 contains a Cross Site Scripting (XSS) vulnerability in using the display tag that can result in XSS. This vulnerability has been fixed in version 2.2.8.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-1000529 advisory
https://github.com/grails-fields-plugin/grails-fields/issues/278 web
https://github.com/advisories/GHSA-q25j-gcmv-5qpp advisory
https://github.com/grails-fields-plugin/grails-fields package
https://github.com/martinfrancois/CVE-2018-1000529 web