CVEvulnerability

CVE-2018-1271

5.9 MEDIUM Published 2018-04-06 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-04-06
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
Weaknesses
CWE-22

Description

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.

Affected configurations

• vmware spring framework (>= 4.3.0 < 4.3.15) • vmware spring framework (>= 5.0.0 < 5.0.5) • oracle application testing suite 12.5.0.3 • oracle application testing suite 13.1.0.1 • oracle application testing suite 13.2.0.1 • oracle application testing suite 13.3.0.1 • oracle big data discovery 1.6.0 • oracle communications converged application server (< 7.0.0.1) • oracle communications diameter signaling router (< 8.3) • oracle communications performance intelligence center (< 10.2.1) • oracle communications policy management 12.5.0 • oracle communications services gatekeeper (< 6.1.0.4.0) • oracle enterprise manager ops center 12.2.2 • oracle enterprise manager ops center 12.3.3 • oracle goldengate for big data 12.2.0.1 • oracle goldengate for big data 12.3.1.1 • oracle goldengate for big data 12.3.2.1 • oracle health sciences information manager 3.0 • oracle healthcare master person index 3.0 • oracle healthcare master person index 4.0 • oracle insurance calculation engine (>= 11.0.0 <= 11.3.1) • oracle insurance calculation engine 10.1.1 • oracle insurance calculation engine 10.2 • oracle insurance calculation engine 10.2.1 • oracle insurance rules palette 10.0 • oracle insurance rules palette 10.1 • oracle insurance rules palette 10.2 • oracle insurance rules palette 11.0 • oracle insurance rules palette 11.1 • oracle primavera gateway 15.2 • oracle primavera gateway 16.2 • oracle primavera gateway 17.12 • oracle rapid planning 12.1 • oracle rapid planning 12.2 • oracle retail back office 14.0 • oracle retail back office 14.1 • oracle retail central office 14.0 • oracle retail central office 14.1 • oracle retail customer insights 15.0 • oracle retail customer insights 16.0 • oracle retail integration bus 14.0.1 • oracle retail integration bus 14.0.2 • oracle retail integration bus 14.0.3 • oracle retail integration bus 14.0.4 • oracle retail integration bus 14.1.1 • oracle retail integration bus 14.1.2 • oracle retail integration bus 14.1.3 • oracle retail integration bus 15.0.0.1 • oracle retail integration bus 15.0.1 • oracle retail integration bus 15.0.2 • oracle retail integration bus 16.0 • oracle retail integration bus 16.0.1 • oracle retail integration bus 16.0.2 • oracle retail open commerce platform 5.3.0 • oracle retail open commerce platform 6.0.0 • oracle retail open commerce platform 6.0.1 • oracle retail order broker 5.1 • oracle retail order broker 5.2 • oracle retail order broker 15.0 • oracle retail order broker 16.0 … and 12 more

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References