{
  "@id": "urn:uuid:f7e77cbc-3b10-4736-8cb3-b7b8b5a5fb62",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T14:46:48.486669+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.grails/grails-databinding@5.3.6-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.grails/grails-databinding@5.3.6-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:46:48.486669+00:00",
      "status_notes": "Vulnerability CVE-2022-35912 does not affect version 5.3.6-tuxcare.3 of org.grails:grails-databinding. not_affected \u2014 CVE-2022-35912 affects Grails data-binding logic, allowing Remote Code Execution through binding HTTP request parameters to static class properties. The vulnerability exploits the absence of a static modifier check, allowing attackers to modify shared static members. The fix (commit 04b350371f) adds `!Modifier.isStatic(property.modifiers)` to reject binding attempts targeting static properties....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-35912"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-35912 affects Grails data-binding logic, allowing Remote Code Execution through binding HTTP request parameters to static class properties. The vulnerability exploits the absence of a static modifier check, allowing attackers to modify shared static members. The fix (commit 04b350371f) adds `!Modifier.isStatic(property.modifiers)` to reject binding attempts targeting static properties...."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.grails/grails-databinding@5.3.6-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.grails/grails-databinding@5.3.6-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T11:18:00.109709+00:00",
      "status_notes": "Vulnerability CVE-2023-46131 does not affect version 5.3.6-tuxcare.3 of org.grails:grails-databinding. not_affected \u2014 The target grails-core 5.3.6-tuxcare.3 is NOT vulnerable to CVE-2023-46131. The security fix that prevents binding to dangerous Groovy metaclass properties (metaPropertyValues, properties, MetaProperty.class, CachedMethod.class) was already present in the upstream Grails 5.3.6 release that TuxCare onboarded. The fix was authored by Puneet Behl (upstream contributor) on 2023-11-01, merged before...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-46131"
      },
      "impact_statement": "not_affected \u2014 The target grails-core 5.3.6-tuxcare.3 is NOT vulnerable to CVE-2023-46131. The security fix that prevents binding to dangerous Groovy metaclass properties (metaPropertyValues, properties, MetaProperty.class, CachedMethod.class) was already present in the upstream Grails 5.3.6 release that TuxCare onboarded. The fix was authored by Puneet Behl (upstream contributor) on 2023-11-01, merged before..."
    }
  ]
}