org.springframework:spring-webmvc
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- Maven
- Vulnerability status
- affected by 14 advisory(ies)
Advisories (27)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-2m8h-fgr8-2q9w Pivotal Spring Framework Paths provided to the ResourceServlet were not properly sanitized | < 3.2.18 ; 4.2.0 – < 4.2.9 ; 4.3.0 – < 4.3.5 | Affected |
| GHSA-36p3-wjmg-h94x Remote Code Execution in Spring Framework | < 5.2.20.RELEASE ; 5.3.0 – < 5.3.18 | Affected |
| GHSA-3chg-m5w7-qfv5 Spring Framework Cross-site Scripting via JavaScriptUtils | 7.0.0 – < 7.0.8 ; 6.2.0 – < 6.2.19 ; 6.1.0 – 6.1.21 ; … | Affected |
| GHSA-4773-3jfm-qmx3 Spring Framework Improper Path Limitation with Script View Templates | 7.0.0-M1 – < 7.0.6 ; 6.2.0 – < 6.2.17 ; 6.0.0 – 6.1.21 ; … | Not affected |
| GHSA-6hcq-hmm3-jj3c Spring MVC and WebFlux has Server Sent Event stream corruption | 7.0.0-M1 – < 7.0.6 ; 6.2.0 – < 6.2.17 ; 6.0.0 – 6.1.21 ; … | Not affected |
| GHSA-6p4f-wcwh-5vvm Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources | 7.0.0 – < 7.0.7 ; 6.2.0 – < 6.2.18 ; 6.1.0 – 6.1.26 ; … | Affected |
| GHSA-72pg-x5f8-j25j Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux | 7.0.0 – < 7.0.8 ; 6.2.0 – < 6.2.19 ; 6.1.0 – 6.1.21 ; … | Affected |
| GHSA-7phw-cxx7-q9vq Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch | 6.0.0 – < 6.0.7 ; 5.3.0 – < 5.3.26 | Not affected |
| GHSA-7pm4-g2qj-j85x CSRF attack via CORS preflight requests with Spring MVC or Spring WebFlux | 5.2.0 – < 5.2.3 | Not affected |
| GHSA-8cmm-qj8g-fcp6 Cross-Site Request Forgery in Spring Framework | < 3.2.8 ; 4.0.0 – < 4.0.2 | Affected |
| GHSA-8wx2-9q48-vm9r RFD attack via Content-Disposition header sourced from request input by Spring MVC or Spring WebFlux Application | 5.2.0.RELEASE – < 5.2.3.RELEASE ; 5.1.0.RELEASE – < 5.1.13.RELEASE ; 5.0.0.RELEASE – < 5.0.16.RELEASE | Not affected |
| GHSA-957g-f97v-vppc Spring Framework Cross-site Scripting via JSP Form Tags | 7.0.0 – < 7.0.8 ; 6.2.0 – < 6.2.19 ; 6.1.0 – 6.1.21 ; … | Affected |
| GHSA-cjpg-rgq5-fr37 Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux | 7.0.0 – < 7.0.8 ; 6.2.0 – < 6.2.19 ; 6.1.0 – 6.1.21 ; … | Affected |
| GHSA-cx7f-g6mp-7hqm Path traversal vulnerability in functional web frameworks | 6.1.0 – < 6.1.13 ; 6.0.0 – 6.0.23 ; 5.3.0 – 5.3.39 | Not affected |
| GHSA-f93f-g33r-8pcp Improper Restriction of XML External Entity Reference in Spring Framework | 4.0.0 – < 4.0.5 ; 3.0.0 – < 3.2.8 | Not affected |
| GHSA-ff7p-jqjm-v66h Improper Neutralization of Input During Web Page Generation in Spring Framework | 3.0.0 – < 3.2.8.RELEASE ; 4.0.0 – < 4.0.2.RELEASE | Not affected |
| GHSA-g5vr-rgqm-vf78 Spring Framework Path Traversal vulnerability | 6.1.0 – < 6.1.14 ; ≤ 5.3.40 ; 6.0.0 – 6.0.24 | Affected |
| GHSA-h3qp-gqrc-q736 Spring Framework Open Redirect in Spring MVC and WebFlux | 7.0.0 – < 7.0.8 ; 6.2.0 – < 6.2.19 ; 6.1.0 – 6.1.21 ; … | Affected |
| GHSA-hhm4-hwq6-3c6w Improper Limitation of a Pathname to a Restricted Directory in Spring Framework | 3.0.4 – < 3.2.12 ; 4.0.0 – < 4.0.8 ; 4.1.0 – < 4.1.2 | Not affected |
| GHSA-j9f9-w8pj-32f8 Spring Framework Server Sent Event stream corruption while rendering fragments | 6.2.0 – 6.2.19 ; 7.0.0 – < 7.0.9 | Not affected |
| GHSA-mq64-j8f9-9gcj Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux | 7.0.0 – < 7.0.8 ; 6.2.0 – < 6.2.19 ; 6.1.0 – 6.1.21 ; … | Affected |
| GHSA-pc63-qcmh-9cmg Spring Framework Improper Path Limitation in XsltView | ≤ 5.2.25.RELEASE ; 5.3.0 – 5.3.49 ; 6.0.0 – 6.0.30 ; … | Affected |
| GHSA-r936-gwx5-v52f Spring Framework MVC Applications Path Traversal Vulnerability | 6.2.0 – < 6.2.10 ; 6.1.0 – 6.1.21 ; 6.0.0 – 6.0.29 ; … | Not affected |
| GHSA-v94h-hvhg-mf9h Spring Framework vulnerable to denial of service | 6.0.0 – < 6.0.14 | Not affected |
| GHSA-w3c8-7r8f-9jp8 Spring MVC controller vulnerable to a DoS attack | 5.3.0 – < 5.3.42 | Not affected |
| GHSA-wg35-8jpf-2xv3 Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. | 7.0.0 – < 7.0.7 ; 6.2.0 – < 6.2.18 ; 6.1.0 – 6.1.26 ; … | Affected |
| GHSA-x23c-287f-qqv5 Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux | 7.0.0 – < 7.0.8 ; 6.2.0 – < 6.2.19 ; 6.1.0 – 6.1.21 ; … | Affected |
Sources
| Source | Licence |
|---|