Vulnerability GHSA-g5vr-rgqm-vf78
High Risk
HIGH RISK
CVSS Score: 7.5
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
1 year ago
December 19, 2024 at 06:31 PM UTC
Spring Framework Path Traversal vulnerability
==5.0.0.RELEASE, ==5.0.1.RELEASE, ==5.0.10.RELEASE, ==5.0.11.RELEASE, ==5.0.12.RELEASE, ==5.0.13.RELEASE, ==5.0.14.RELEASE, ==5.0.15.RELEASE, ==5.0.16.RELEASE, ==5.0.17.RELEASE, ==5.0.18.RELEASE, ==5.0.19.RELEASE, ==5.0.2.RELEASE, ==5.0.20.RELEASE, ==5.0.3.RELEASE, ==5.0.4.RELEASE, ==5.0.5.RELEASE, ==5.0.6.RELEASE, ==5.0.7.RELEASE, ==5.0.8.RELEASE, ==5.0.9.RELEASE, ==5.1.0.RELEASE, ==5.1.1.RELEASE, ==5.1.10.RELEASE, ==5.1.11.RELEASE, ==5.1.12.RELEASE, ==5.1.13.RELEASE, ==5.1.14.RELEASE, ==5.1.15.RELEASE, ==5.1.16.RELEASE, ==5.1.17.RELEASE, ==5.1.18.RELEASE, ==5.1.19.RELEASE, ==5.1.2.RELEASE, ==5.1.20.RELEASE, ==5.1.3.RELEASE, ==5.1.4.RELEASE, ==5.1.5.RELEASE, ==5.1.6.RELEASE, ==5.1.7.RELEASE, ==5.1.8.RELEASE, ==5.1.9.RELEASE, ==5.2.0.RELEASE, ==5.2.1.RELEASE, ==5.2.10.RELEASE, ==5.2.11.RELEASE, ==5.2.12.RELEASE, ==5.2.13.RELEASE, ==5.2.14.RELEASE, ==5.2.15.RELEASE, ==5.2.16.RELEASE, ==5.2.17.RELEASE, ==5.2.18.RELEASE, ==5.2.19.RELEASE, ==5.2.2.RELEASE, ==5.2.20.RELEASE, ==5.2.21.RELEASE, ==5.2.22.RELEASE, ==5.2.23.RELEASE, ==5.2.24.RELEASE, ==5.2.25.RELEASE, ==5.2.3.RELEASE, ==5.2.4.RELEASE, ==5.2.5.RELEASE, ==5.2.6.RELEASE, ==5.2.7.RELEASE, ==5.2.8.RELEASE, ==5.2.9.RELEASE, >=5.3.0 <5.3.40, >=6.0.0 <6.0.24, >=6.1.0 <6.1.14
==5.0.0.RELEASE, ==5.0.1.RELEASE, ==5.0.10.RELEASE, ==5.0.11.RELEASE, ==5.0.12.RELEASE, ==5.0.13.RELEASE, ==5.0.14.RELEASE, ==5.0.15.RELEASE, ==5.0.16.RELEASE, ==5.0.17.RELEASE, ==5.0.18.RELEASE, ==5.0.19.RELEASE, ==5.0.2.RELEASE, ==5.0.20.RELEASE, ==5.0.3.RELEASE, ==5.0.4.RELEASE, ==5.0.5.RELEASE, ==5.0.6.RELEASE, ==5.0.7.RELEASE, ==5.0.8.RELEASE, ==5.0.9.RELEASE, ==5.1.0.RELEASE, ==5.1.1.RELEASE, ==5.1.10.RELEASE, ==5.1.11.RELEASE, ==5.1.12.RELEASE, ==5.1.13.RELEASE, ==5.1.14.RELEASE, ==5.1.15.RELEASE, ==5.1.16.RELEASE, ==5.1.17.RELEASE, ==5.1.18.RELEASE, ==5.1.19.RELEASE, ==5.1.2.RELEASE, ==5.1.20.RELEASE, ==5.1.3.RELEASE, ==5.1.4.RELEASE, ==5.1.5.RELEASE, ==5.1.6.RELEASE, ==5.1.7.RELEASE, ==5.1.8.RELEASE, ==5.1.9.RELEASE, ==5.2.0.RELEASE, ==5.2.1.RELEASE, ==5.2.10.RELEASE, ==5.2.11.RELEASE, ==5.2.12.RELEASE, ==5.2.13.RELEASE, ==5.2.14.RELEASE, ==5.2.15.RELEASE, ==5.2.16.RELEASE, ==5.2.17.RELEASE, ==5.2.18.RELEASE, ==5.2.19.RELEASE, ==5.2.2.RELEASE, ==5.2.20.RELEASE, ==5.2.21.RELEASE, ==5.2.22.RELEASE, ==5.2.23.RELEASE, ==5.2.24.RELEASE, ==5.2.25.RELEASE, ==5.2.3.RELEASE, ==5.2.4.RELEASE, ==5.2.5.RELEASE, ==5.2.6.RELEASE, ==5.2.7.RELEASE, ==5.2.8.RELEASE, ==5.2.9.RELEASE, >=5.3.0 <5.3.40, >=6.0.0 <6.0.24, >=6.1.0 <6.1.14
Summary
Spring Framework Path Traversal vulnerability
Details
Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
3 months ago
Spring Framework Cross-site Scripting via JSP Form Tags
1.0.0 - 1.0.1 GHSA-957g-f97v-vppc
1.0.0 - 1.0.1 GHSA-957g-f97v-vppc
Medium Risk
3 months ago
Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux
1.0.0 - 1.0.1 GHSA-cjpg-rgq5-fr37
1.0.0 - 1.0.1 GHSA-cjpg-rgq5-fr37
Medium Risk
3 months ago
Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux
1.0.0 - 1.0.1 GHSA-cjpg-rgq5-fr37
1.0.0 - 1.0.1 GHSA-cjpg-rgq5-fr37
Medium Risk
3 months ago
Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL
==5.0.0.RELEASE, ==5.0.1.RELEASE, ==5.0.10.RELEASE, ==5.0.11.RELEASE, ==5.0.12.RELEASE, ==5.0.13.RELEASE, ==5.0.14.RELEASE, ==5.0.15.RELEASE, ==5.0.16.RELEASE, ==5.0.17.RELEASE, ==5.0.18.RELEASE, ==5.0.19.RELEASE, ==5.0.2.RELEASE, ==5.0.20.RELEASE, ==5.0.3.RELEASE, ==5.0.4.RELEASE, ==5.0.5.RELEASE, ==5.0.6.RELEASE, ==5.0.7.RELEASE, ==5.0.8.RELEASE, ==5.0.9.RELEASE, ==5.1.0.RELEASE, ==5.1.1.RELEASE, ==5.1.10.RELEASE, ==5.1.11.RELEASE, ==5.1.12.RELEASE, ==5.1.13.RELEASE, ==5.1.14.RELEASE, ==5.1.15.RELEASE, ==5.1.16.RELEASE, ==5.1.17.RELEASE, ==5.1.18.RELEASE, ==5.1.19.RELEASE, ==5.1.2.RELEASE, ==5.1.20.RELEASE, ==5.1.3.RELEASE, ==5.1.4.RELEASE, ==5.1.5.RELEASE, ==5.1.6.RELEASE, ==5.1.7.RELEASE, ==5.1.8.RELEASE, ==5.1.9.RELEASE, ==5.2.0.RELEASE, ==5.2.1.RELEASE, ==5.2.10.RELEASE, ==5.2.11.RELEASE, ==5.2.12.RELEASE, ==5.2.13.RELEASE, ==5.2.14.RELEASE, ==5.2.15.RELEASE, ==5.2.16.RELEASE, ==5.2.17.RELEASE, ==5.2.18.RELEASE, ==5.2.19.RELEASE, ==5.2.2.RELEASE, ==5.2.20.RELEASE, ==5.2.21.RELEASE, ==5.2.22.RELEASE, ==5.2.23.RELEASE, ==5.2.24.RELEASE, ==5.2.25.RELEASE, ==5.2.3.RELEASE, ==5.2.4.RELEASE, ==5.2.5.RELEASE, ==5.2.6.RELEASE, ==5.2.7.RELEASE, ==5.2.8.RELEASE, ==5.2.9.RELEASE, >=5.3.0 <5.3.40 GHSA-vqgp-pf68-6947
==5.0.0.RELEASE, ==5.0.1.RELEASE, ==5.0.10.RELEASE, ==5.0.11.RELEASE, ==5.0.12.RELEASE, ==5.0.13.RELEASE, ==5.0.14.RELEASE, ==5.0.15.RELEASE, ==5.0.16.RELEASE, ==5.0.17.RELEASE, ==5.0.18.RELEASE, ==5.0.19.RELEASE, ==5.0.2.RELEASE, ==5.0.20.RELEASE, ==5.0.3.RELEASE, ==5.0.4.RELEASE, ==5.0.5.RELEASE, ==5.0.6.RELEASE, ==5.0.7.RELEASE, ==5.0.8.RELEASE, ==5.0.9.RELEASE, ==5.1.0.RELEASE, ==5.1.1.RELEASE, ==5.1.10.RELEASE, ==5.1.11.RELEASE, ==5.1.12.RELEASE, ==5.1.13.RELEASE, ==5.1.14.RELEASE, ==5.1.15.RELEASE, ==5.1.16.RELEASE, ==5.1.17.RELEASE, ==5.1.18.RELEASE, ==5.1.19.RELEASE, ==5.1.2.RELEASE, ==5.1.20.RELEASE, ==5.1.3.RELEASE, ==5.1.4.RELEASE, ==5.1.5.RELEASE, ==5.1.6.RELEASE, ==5.1.7.RELEASE, ==5.1.8.RELEASE, ==5.1.9.RELEASE, ==5.2.0.RELEASE, ==5.2.1.RELEASE, ==5.2.10.RELEASE, ==5.2.11.RELEASE, ==5.2.12.RELEASE, ==5.2.13.RELEASE, ==5.2.14.RELEASE, ==5.2.15.RELEASE, ==5.2.16.RELEASE, ==5.2.17.RELEASE, ==5.2.18.RELEASE, ==5.2.19.RELEASE, ==5.2.2.RELEASE, ==5.2.20.RELEASE, ==5.2.21.RELEASE, ==5.2.22.RELEASE, ==5.2.23.RELEASE, ==5.2.24.RELEASE, ==5.2.25.RELEASE, ==5.2.3.RELEASE, ==5.2.4.RELEASE, ==5.2.5.RELEASE, ==5.2.6.RELEASE, ==5.2.7.RELEASE, ==5.2.8.RELEASE, ==5.2.9.RELEASE, >=5.3.0 <5.3.40 GHSA-vqgp-pf68-6947
High Risk
3 months ago
Spring Framework Cross-site Scripting via JavaScriptUtils
1.0.0 - 1.0.1 GHSA-3chg-m5w7-qfv5
1.0.0 - 1.0.1 GHSA-3chg-m5w7-qfv5
Impacted packages
Timeline
Published
1 year ago
December 19, 2024 at 06:31 PM UTC
Fixed (6.1.14)
Unknown
Unknown
Fixed (6.1.14)
Unknown
Unknown
Last Modified
3 hours ago
September 28, 2026 at 04:00 PM UTC