An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libspring-java | Jul 15, 2019 | Dec 29, 2016 |
| Red Hat Jboss Eap | — | — | Sep 19, 2024 | Dec 21, 2016 |
| Ubuntu | — | Upgrade libspring-web-struts-java (Ubuntu Pro)Upgrade libspring-beans-java (Ubuntu Pro)Upgrade libspring-web-servlet-java (Ubuntu Pro)Upgrade libspring-aop-java (Ubuntu Pro)Upgrade libspring-jdbc-java (Ubuntu Pro)Upgrade libspring-expression-java (Ubuntu Pro)Upgrade libspring-web-portlet-java (Ubuntu Pro)Upgrade libspring-core-java (Ubuntu Pro)Upgrade libspring-orm-java (Ubuntu Pro)Upgrade libspring-transaction-java (Ubuntu Pro)Upgrade libspring-instrument-java (Ubuntu Pro)Upgrade libspring-context-support-java (Ubuntu Pro)Upgrade libspring-jms-java (Ubuntu Pro)Upgrade libspring-web-java (Ubuntu Pro)Upgrade libspring-context-java (Ubuntu Pro)Upgrade libspring-oxm-java (Ubuntu Pro) | Mar 22, 2023 | Dec 29, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub