CVE-2016-6521

Cross-site request forgery (CSRF) vulnerability in Grails console (aka Grails Debug Console and Grails Web Console) 2.0.7, 1.5.10, and earlier allows remote attackers to hijack the authentication of users for requests that execute arbitrary Groovy code via unspecified vectors.

• CWE-352

• http://www.openwall.com/lists/oss-security/2016/08/02/11Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/08/02/2Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/08/03/9Third Party Advisory
• http://www.securityfocus.com/bid/92267
• https://github.com/sheehan/grails-console/issues/54Exploit, Vendor Advisory
• https://github.com/sheehan/grails-console/issues/55Patch, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2016/08/02/11Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/08/02/2Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/08/03/9Third Party Advisory
• http://www.securityfocus.com/bid/92267
• https://github.com/sheehan/grails-console/issues/54Exploit, Vendor Advisory
• https://github.com/sheehan/grails-console/issues/55Patch, Vendor Advisory

Published

Jan 23, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-6515The auth_password function in auth-passwd.c in sshd in OpenS…
• CVE-2016-6516Race condition in the ioctl_file_dedupe_range function in fs…
• CVE-2016-6517Directory traversal vulnerability in Liferay 5.1.0 allows re…
• CVE-2016-6518Memory leak in Huawei S9300, S5300, S5700, S6700, S7700, S97…
• CVE-2016-6519Cross-site scripting (XSS) vulnerability in the "Shares" ove…
• CVE-2016-6520Buffer overflow in MagickCore/enhance.c in ImageMagick befor…9.1
• CVE-2016-6522Integer overflow in the uvm_map_isavail function in uvm/uvm_…
• CVE-2016-6523Multiple cross-site scripting (XSS) vulnerabilities in the m…
• CVE-2016-6525Heap-based buffer overflow in the pdf_load_mesh_params funct…
• CVE-2016-6526The SpamCall Activity component in Telecom application on Sa…
• CVE-2016-6527The SmartCall Activity component in Telecom application on S…
• CVE-2016-6530Dentsply Sirona (formerly Schick) CDR Dicom 5 and earlier ha…