GitHub Advisoryadvisory · Maven

GHSA-2m8h-fgr8-2q9w Pivotal Spring Framework Paths provided to the ResourceServlet were not properly sanitized

HIGH Published 2018-10-04 Modified 2024-03-05 Official page ↗
Aliases
CVE-2016-9878
Ecosystem
Maven
Packages
org.springframework:spring-webmvc
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2020-06-16

Affected packages

• Maven org.springframework:spring-webmvc: < 3.2.18 → fixed in 3.2.18 • Maven org.springframework:spring-webmvc: >= 4.2.0, < 4.2.9 → fixed in 4.2.9 • Maven org.springframework:spring-webmvc: >= 4.3.0, < 4.3.5 → fixed in 4.3.5

Description

An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks.

Related

Alias · CVE (1)

  • CVE-2016-9878 An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References