Improper Limitation of a Pathname to a Restricted Directory in Spring Framework

2022-05-1301:02:39

Google

osv.dev

0.005 Low

EPSS

Percentile

76.0%

JSON

Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling.

CPENameOperatorVersion
org.springframework:spring-webmvceq3.0.5.RELEASE
org.springframework:spring-webmvceq4.0.6.RELEASE
org.springframework:spring-webmvceq3.1.4.RELEASE
org.springframework:spring-webmvceq3.2.3.RELEASE
org.springframework:spring-webmvceq3.1.3.RELEASE
org.springframework:spring-webmvceq3.2.6.RELEASE
org.springframework:spring-webmvceq4.0.2.RELEASE
org.springframework:spring-webmvceq3.2.1.RELEASE
org.springframework:spring-webmvceq3.0.7.RELEASE
org.springframework:spring-webmvceq3.1.2.RELEASE

Name	Operator	Version
org.springframework:spring-webmvc	eq	3.0.5.RELEASE
org.springframework:spring-webmvc	eq	4.0.6.RELEASE
org.springframework:spring-webmvc	eq	3.1.4.RELEASE
org.springframework:spring-webmvc	eq	3.2.3.RELEASE
org.springframework:spring-webmvc	eq	3.1.3.RELEASE
org.springframework:spring-webmvc	eq	3.2.6.RELEASE
org.springframework:spring-webmvc	eq	4.0.2.RELEASE
org.springframework:spring-webmvc	eq	3.2.1.RELEASE
org.springframework:spring-webmvc	eq	3.0.7.RELEASE
org.springframework:spring-webmvc	eq	3.1.2.RELEASE