GHSA-g5vr-rgqm-vf78
Spring Framework Path Traversal vulnerability
At a glance
- Published
- Updated
- CVE
- CVE-2024-38819
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.springframework:spring-webflux | introduced 6.1.0, fixed 6.1.14 |
| Maven · org.springframework:spring-webmvc | introduced 6.1.0, fixed 6.1.14 |
| Maven · org.springframework:spring-webflux | introduced 0, last affected 5.3.40 |
| Maven · org.springframework:spring-webmvc | introduced 0, last affected 5.3.40 |
| Maven · org.springframework:spring-webflux | introduced 6.0.0, last affected 6.0.24 |
| Maven · org.springframework:spring-webmvc | introduced 6.0.0, last affected 6.0.24 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-38819 ADVISORY
- https://github.com/spring-projects/spring-framework/issues/33689 WEB
- https://github.com/spring-projects/spring-framework/commit/3bfbe30a7814c9ea1556d40df9bd87ddb3ba372d WEB
- https://github.com/spring-projects/spring-framework/commit/fb7890d73975a3d9e0763e0926df2bd0a608e87e WEB
- https://github.com/spring-projects/spring-framework PACKAGE
- https://security.netapp.com/advisory/ntap-20250110-0010 WEB
- https://spring.io/security/cve-2024-38819 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |