{"id":"CVE-2014-2857","published":"2014-04-15T18:00:00Z","modified":"2024-08-06T10:28:46Z","title":"The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 does not…","vendor":null,"product":null,"tier":"tail","description":{"text":"The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 does not properly restrict access to files in the META-INF directory, which allows remote attackers to obtain sensitive information via a direct request.  NOTE: this issue was SPLIT from CVE-2014-0053 due to different researchers per ADT5.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01354,"percentile":0.71493,"provenance":"source"},"cwes":[],"references":[{"url":"http://www.securityfocus.com/archive/1/531281/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"http://www.gopivotal.com/security/cve-2014-0053","tags":["x_refsource_CONFIRM"]},{"url":"http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0267.html","tags":["mailing-list","x_refsource_FULLDISC"]}],"priority":{"score":14.3,"factors":[{"name":"EPSS percentile","points":14.3}]},"euvd":{"id":"EUVD-2014-2881","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-cve-2014-0053-family-cve-2014-0053","children":[{"from":"CVE-2014-2857","to":"CVE-2014-0053","relation":"variant","confidence":"high","kind":"lineage","orderedBy":"description","evidence":[{"kind":"text","provenance":"source","relation":"variant","quote":"See CVE-2014-2857 for the META-INF variant and CVE-2014-2858 for the directory traversal.","from":"CVE.org","in":"CVE-2014-0053"}]}]}}