Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5
En bref
- Source
- NVD
- EPSS
- EPSS 4.91 % · centile 92 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- dell
- Statut NVD
- Modified
Rechercher sur…
Description
An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks.
Faiblesses (CWE)
- CWE-22 — Traversée de répertoire
Références
- http://www.securitytracker.com/id/1040698
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- https://security.netapp.com/advisory/ntap-20180419-0002/
- https://pivotal.io/security/cve-2016-9878
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- http://www.securityfocus.com/bid/95072
- https://access.redhat.com/errata/RHSA-2017:3115
- https://lists.debian.org/debian-lts-announce/2019/07/msg00012.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | HIGH 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-2m8h-fgr8-2q9w — Pivotal Spring Framework Paths provided to the ResourceServlet were not properly sanitized
Références européennes
- ENISA EUVD · EUVD-2018-0477
- GCVE · GCVE-0-2016-9878
Avis du CERT-FR
- CERTFR-2018-AVI-191 — Multiples vulnérabilités dans Oracle MySQL · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:pivotal_software:spring_framework:*:*:*:*:*:*:*:*≤ 3.2.0cpe:2.3:a:pivotal_software:spring_framework:4.2.0:*:*:*:*:*:*:*cpe:2.3:a:pivotal_software:spring_framework:4.3.0:*:*:*:*:*:*:*cpe:2.3:a:vmware:spring_framework:3.2.1:*:*:*:*:*:*:*cpe:2.3:a:vmware:spring_framework:3.2.2:*:*:*:*:*:*:*cpe:2.3:a:vmware:spring_framework:3.2.3:*:*:*:*:*:*:*cpe:2.3:a:vmware:spring_framework:3.2.4:*:*:*:*:*:*:*cpe:2.3:a:vmware:spring_framework:3.2.5:*:*:*:*:*:*:*cpe:2.3:a:vmware:spring_framework:3.2.6:*:*:*:*:*:*:*cpe:2.3:a:vmware:spring_framework:3.2.7:*:*:*:*:*:*:*cpe:2.3:a:vmware:spring_framework:3.2.8:*:*:*:*:*:*:*cpe:2.3:a:vmware:spring_framework:3.2.9:*:*:*:*:*:*:*cpe:2.3:a:vmware:spring_framework:3.2.10:*:*:*:*:*:*:*cpe:2.3:a:vmware:spring_framework:3.2.11:*:*:*:*:*:*:*cpe:2.3:a:vmware:spring_framework:3.2.12:*:*:*:*:*:*:*cpe:2.3:a:vmware:spring_framework:3.2.13:*:*:*:*:*:*:*cpe:2.3:a:vmware:spring_framework:3.2.14:*:*:*:*:*:*:*cpe:2.3:a:vmware:spring_framework:3.2.15:*:*:*:*:*:*:*cpe:2.3:a:vmware:spring_framework:3.2.16:*:*:*:*:*:*:*cpe:2.3:a:vmware:spring_framework:3.2.17:*:*:*:*:*:*:*cpe:2.3:a:vmware:spring_framework:4.2.1:*:*:*:*:*:*:*cpe:2.3:a:vmware:spring_framework:4.2.2:*:*:*:*:*:*:*cpe:2.3:a:vmware:spring_framework:4.2.3:*:*:*:*:*:*:*cpe:2.3:a:vmware:spring_framework:4.2.4:*:*:*:*:*:*:*cpe:2.3:a:vmware:spring_framework:4.2.5:*:*:*:*:*:*:*cpe:2.3:a:vmware:spring_framework:4.2.6:*:*:*:*:*:*:*cpe:2.3:a:vmware:spring_framework:4.2.7:*:*:*:*:*:*:*cpe:2.3:a:vmware:spring_framework:4.2.8:*:*:*:*:*:*:*cpe:2.3:a:vmware:spring_framework:4.3.1:*:*:*:*:*:*:*cpe:2.3:a:vmware:spring_framework:4.3.2:*:*:*:*:*:*:*cpe:2.3:a:vmware:spring_framework:4.3.3:*:*:*:*:*:*:*cpe:2.3:a:vmware:spring_framework:4.3.4:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5 | affected Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |