CVE-2012-1833
VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data...
CVE-2012-1833 is a medium vulnerability (CVSS 5.0) in Springsource Grails, published September 28, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.43%, the 73rd percentile. No source names a fixed version.
VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which might allow remote attackers to bypass intended access restrictions and modify arbitrary object properties via a crafted request parameter to an application.
Exploit likelihood
What each source reports
NVD Score used
VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which might allow remote attackers to bypass intended access restrictions and modify arbitrary object properties via a crafted request parameter to an application.
- Record
CVE-2012-1833- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which might allow remote attackers to bypass intended access restrictions and modify arbitrary object properties via a crafted request parameter to an application.
- Record
CVE-2012-1833- Updated
- 2026-11-02
EUVDEUVD-2012-1843 No score
VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which might allow remote attackers to bypass intended access restrictions and modify arbitrary object properties via a crafted request parameter to an application.
- Record
EUVD-2012-1843- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-74r6-f5w3-4rxg No score
VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data...
VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which might allow remote attackers to bypass intended access restrictions and modify arbitrary object properties via a crafted request parameter to an application.
- Record
GHSA-74r6-f5w3-4rxg- Updated
- 2026-11-02
Affected products
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD |