VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which might allow remote attackers to bypass intended access restrictions and modify arbitrary object properties via a crafted request parameter to an application.
AV:N/AC:L/Au:N/C:N/I:P/A:N
This vulnerability has a 1.43% probability of being exploited in the next 30 days, ranking higher than 72% of all scored CVEs.