What’s Vulnerable › Vulnerabilities

CVE-2015-3253

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 41.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2015-08-13 · updated 2026-06-17
• Weakness: CWE-74

Description

The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.

Affected products

• Apache Groovy: 1.7.0, 1.7.0-beta_1, 1.7.0-beta_2, 1.7.0-rc1, 1.7.0-rc2, 1.7.1 (+97)
• Oracle Health Sciences Clinical Development Center: 3.1.1, 3.1.2
• Oracle Retail Order Broker Cloud Service: 4.1, 5.1, 5.2, 15.0
• Oracle Retail Service Backbone: 13.0, 13.1, 13.2, 14.0, 14.1, 15.0
• Oracle Corporation Retail Store Inventory Management: 13.2, 14.0, 14.1
• Oracle Corporation Oracle WebCenter Sites: 11.1.1.8.0, 12.2.1

References

• http://groovy-lang.org/security.html
• http://packetstormsecurity.com/files/132714/Apache-Groovy-2.4.3-Code-Execution.html
• http://rhn.redhat.com/errata/RHSA-2016-0066.html
• http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
• http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
• http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
• http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
• http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
• http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
• http://www.securityfocus.com/archive/1/536012/100/0/threaded
• http://www.securityfocus.com/bid/75919
• http://www.securityfocus.com/bid/91787

Get alerted when CVE-2015-3253 or the next vulnerability affects your stack