GitHub Advisoryadvisory · Maven

GHSA-g8hw-794c-4j9g Path Traversal in org.springframework:spring-core

MEDIUM Published 2018-10-17 Modified 2024-03-07 Official page ↗
Aliases
CVE-2018-1271
Ecosystem
Maven
Packages
org.springframework:spring-core
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2020-06-16

Affected packages

• Maven org.springframework:spring-core: >= 5.0.0, < 5.0.5 → fixed in 5.0.5 • Maven org.springframework:spring-core: < 4.3.15 → fixed in 4.3.15

Description

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.

Related

Alias · CVE (1)

  • CVE-2018-1271 Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References