Apache Groovy vulnerabilities

3 CVEs affecting Apache Groovy, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-17521, published 2020-12-07.

More from Apache.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2015-3253, published 2015-08-13. Critical severity, CVSS 9.8. EPSS: 41% chance of exploitation in the next 30 days. The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized…
• CVE-2016-6814, published 2018-01-18. Critical severity, CVSS 9.8. EPSS: 17.2% chance of exploitation in the next 30 days. When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate…
• CVE-2020-17521, published 2020-12-07. Medium severity, CVSS 5.5. EPSS: 1% chance of exploitation in the next 30 days. Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method…