GitStock

spring-projects/spring-framework · Security

Pivotal Spring Framework Paths provided to the ResourceServlet were not properly sanitized

GHSA ID
GHSA-2m8h-fgr8-2q9w
CVE ID
CVE-2016-9878
Severity
high
Published
Updated
CVSS
7.5 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v3
7.5 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks.

CWEs

  • CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

References