{"id":"CVE-2014-0053","published":"2014-04-15T18:00:00Z","modified":"2024-08-06T09:05:38Z","title":"The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 before 2.3.6 does not…","vendor":null,"product":null,"tier":"tail","description":{"text":"The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 before 2.3.6 does not properly restrict access to files in the WEB-INF directory, which allows remote attackers to obtain sensitive information via a direct request.  NOTE: this identifier has been SPLIT due to different researchers and different vulnerability types. See CVE-2014-2857 for the META-INF variant and CVE-2014-2858 for the directory traversal.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01979,"percentile":0.80464,"provenance":"source"},"cwes":[],"references":[{"url":"http://secunia.com/advisories/56841","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/91270","tags":["vdb-entry","x_refsource_XF"]},{"url":"http://www.securityfocus.com/archive/1/531281/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"http://www.securityfocus.com/bid/65678","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://www.gopivotal.com/security/cve-2014-0053","tags":["x_refsource_CONFIRM"]},{"url":"https://twitter.com/Ramsharan065/status/434975409134792704","tags":["x_refsource_MISC"]},{"url":"http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0267.html","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0194.html","tags":["mailing-list","x_refsource_FULLDISC"]}],"priority":{"score":16.1,"factors":[{"name":"EPSS percentile","points":16.09}]},"euvd":{"id":"EUVD-2014-0148","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-cve-2014-0053-family-cve-2014-0053","parents":[{"from":"CVE-2014-2857","to":"CVE-2014-0053","relation":"variant","confidence":"high","kind":"lineage","orderedBy":"description","evidence":[{"kind":"text","provenance":"source","relation":"variant","quote":"See CVE-2014-2857 for the META-INF variant and CVE-2014-2858 for the directory traversal.","from":"CVE.org","in":"CVE-2014-0053"}]},{"from":"CVE-2014-2858","to":"CVE-2014-0053","relation":"variant","confidence":"high","kind":"lineage","orderedBy":"description","evidence":[{"kind":"text","provenance":"source","relation":"variant","quote":"See CVE-2014-2857 for the META-INF variant and CVE-2014-2858 for the directory traversal.","from":"CVE.org","in":"CVE-2014-0053"}]}]}}