Improper Limitation of a Pathname to a Restricted Directory in Spring Framework

2022-05-1400:56:29

Google

osv.dev

0.003 Low

EPSS

Percentile

69.7%

JSON

Directory traversal vulnerability in Pivotal Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5 allows remote attackers to read arbitrary files via a crafted URL.

CPENameOperatorVersion
org.springframework:spring-coreeq3.2.8.RELEASE
org.springframework:spring-coreeq3.0.5.RELEASE
org.springframework:spring-coreeq3.1.4.RELEASE
org.springframework:spring-coreeq3.2.1.RELEASE
org.springframework:spring-coreeq3.2.3.RELEASE
org.springframework:spring-coreeq3.1.3.RELEASE
org.springframework:spring-coreeq3.2.6.RELEASE
org.springframework:spring-coreeq4.0.2.RELEASE
org.springframework:spring-coreeq3.0.7.RELEASE
org.springframework:spring-coreeq3.1.2.RELEASE

Name	Operator	Version
org.springframework:spring-core	eq	3.2.8.RELEASE
org.springframework:spring-core	eq	3.0.5.RELEASE
org.springframework:spring-core	eq	3.1.4.RELEASE
org.springframework:spring-core	eq	3.2.1.RELEASE
org.springframework:spring-core	eq	3.2.3.RELEASE
org.springframework:spring-core	eq	3.1.3.RELEASE
org.springframework:spring-core	eq	3.2.6.RELEASE
org.springframework:spring-core	eq	4.0.2.RELEASE
org.springframework:spring-core	eq	3.0.7.RELEASE
org.springframework:spring-core	eq	3.1.2.RELEASE