Pivotal Spring Framework Paths provided to the ResourceServlet were not properly sanitized

2018-10-0420:29:55

Google

osv.dev

0.003 Low

EPSS

Percentile

71.7%

JSON

An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks.

CPENameOperatorVersion
org.springframework:spring-webmvceq2.0.7
org.springframework:spring-webmvceq2.5.5
org.springframework:spring-webmvceq3.2.10.RELEASE
org.springframework:spring-webmvceq1.2.5
org.springframework:spring-webmvceq1.2.2
org.springframework:spring-webmvceq2.5.1
org.springframework:spring-webmvceq1.1-rc2
org.springframework:spring-webmvceq4.2.8.RELEASE
org.springframework:spring-webmvceq3.0.5.RELEASE
org.springframework:spring-webmvceq4.3.2.RELEASE

Name	Operator	Version
org.springframework:spring-webmvc	eq	2.0.7
org.springframework:spring-webmvc	eq	2.5.5
org.springframework:spring-webmvc	eq	3.2.10.RELEASE
org.springframework:spring-webmvc	eq	1.2.5
org.springframework:spring-webmvc	eq	1.2.2
org.springframework:spring-webmvc	eq	2.5.1
org.springframework:spring-webmvc	eq	1.1-rc2
org.springframework:spring-webmvc	eq	4.2.8.RELEASE
org.springframework:spring-webmvc	eq	3.0.5.RELEASE
org.springframework:spring-webmvc	eq	4.3.2.RELEASE