CVE-2015-3253 Improper Neutralization of Special Elements in Output Used by a Downstream Component in Apache Groovy

What is CVE-2015-3253?

CVE-2015-3253 is a critical unsafe deserialization vulnerability in Oracle Webcenter Sites, published on 13 Aug 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.

Weakness: CWE-74

Which versions are affected by CVE-2015-3253?

4 open source packages ship an affected version, including org.codehaus.groovy:groovy and org.codehaus.groovy:groovy-all. It affects 6 products.

Products include Apache Groovy, Oracle Health Sciences Clinical Development Center, Oracle Retail Order Broker Cloud Service, Oracle Retail Service Backbone, Oracle Retail Store Inventory Management, Oracle Webcenter Sites.

How do I fix CVE-2015-3253?

Upgrade org.codehaus.groovy:groovy to 2.4.4 or later.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2015-3253 being exploited?

There is no known exploitation of CVE-2015-3253 in the wild and no public exploit code.

Other vulnerabilities in Oracle Webcenter Sites

• CVE-2016-6814 Deserialization of Untrusted Data in Groovy Critical 9.8

All Oracle Webcenter Sites vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2015-3253, DLA-274-1, GHSA-qg25-hgjv-cg9q, MGASA-2015-0296, MGASA-2017-0333, UBUNTU-CVE-2015-3253.