#VU97224 Path traversal in Pivotal Spring Framework - CVE-2024-38816

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU97224

#VU97224 Path traversal in Pivotal Spring Framework - CVE-2024-38816

Published: September 12, 2024 / Updated: December 4, 2024


Vulnerability identifier: #VU97224
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Green
CVE-ID: CVE-2024-38816
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability: Public exploit is available
Vulnerable software:
Pivotal Spring Framework
Software vendor:
Pivotal

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.

Specifically, an application is vulnerable when both of the following are true:

  • the web application uses RouterFunctions</code> to serve static resources</li><li>resource handling is explicitly configured with a <code>FileSystemResource location


Remediation

Install update from vendor's website.

External links