vulnwire
5.9med

CVE-2018-1271Nuclei template

Path Traversal in org.springframework:spring-core

Also known as GHSA-g8hw-794c-4j9g

Published 8 y ago · modified 4 mo ago · JSON

CVSS
5.9
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
30.3%
percentile 98%
Public exploits
0
none known · Nuclei check

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.

Exploit prediction (EPSS)

30.34% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.

Exploits and detections

  • Nuclei template Spring MVC Framework - Local File Inclusion · nuclei detection template

CVSS scores

Assigned byVersionScoreVector
NVD3.15.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD2.04.3AV:N/AC:M/Au:N/C:P/I:N/A:N
GitHub3.05.9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.springframework:spring-core
>=5.0.0, <5.0.5
<4.3.15
5.0.5
4.3.15

Affected products

  • Spring by Pivotal Spring Framework

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory
Technology feeds
Spring (RSS, critical only)

References

  • securityfocus.com /bid/103699 · vdb-entry, x_refsource_BID, x_transferred
  • access.redhat.com /errata/RHSA-2018:2669 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:2939 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:1320 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • oracle.com /technetwork/security-advisory/cpujul2018-4258247.html · x_refsource_CONFIRM, x_transferred
  • oracle.com /technetwork/security-advisory/cpuoct2018-4428296.html · x_refsource_CONFIRM, x_transferred
  • oracle.com /security-alerts/cpujul2020.html · x_refsource_MISC, x_transferred
  • oracle.com /technetwork/security-advisory/cpujan2019-5072801.html · x_refsource_CONFIRM, x_transferred
  • oracle.com /technetwork/security-advisory/cpujul2019-5072835.html · x_refsource_MISC, x_transferred
  • pivotal.io /security/cve-2018-1271 · x_refsource_CONFIRM, x_transferred
  • oracle.com /security-alerts/cpuoct2021.html · x_refsource_MISC, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2018-1271 · advisory
  • github.com /spring-projects/spring-framework/commit/0e28bee0f155b9bf240b4bafc4646e4810cb23f8 · web
  • github.com /spring-projects/spring-framework/commit/13356a7ee2240f740737c5c83bdccdacc30603ab · web
  • github.com /spring-projects/spring-framework/commit/695bf2961feffd35b5560ccc982a2189dcca611f · web
  • github.com /spring-projects/spring-framework/commit/91b803a2310344d925e5d4b1709bbcea90375548 · web
  • github.com /spring-projects/spring-framework/commit/98ad23bef8e2e04143f8f5b201380543a8d8c0c3 · web
  • github.com /spring-projects/spring-framework/commit/b9ebdaaf3710db473a2e1fec8641c316483a22aa · web
  • github.com /spring-projects/spring-framework/commit/f046a066eceefa0799d1bc89bd6e1318f39bdf69 · web
  • github.com /spring-projects/spring-framework/commit/f59ea610dfcf55cd0b42f6dd76a9b3dab0218aaa · web
  • github.com /advisories/GHSA-g8hw-794c-4j9g · advisory

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.