Improper Limitation of a Pathname to a Restricted Directory in Spring Framework
Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2014-3625US | medium5.0 | Exploit | ||
Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrar… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://rhn.redhat.com/errata/RHSA-2015-0236.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2015-0720.htmlWEB
- http://www.pivotal.io/security/cve-2014-3625WEB
- https://github.com/spring-projects/spring-frameworkPACKAGE
- https://github.com/spring-projects/spring-framework/commit/161d3e3049f129e211f68a4e94b544e0f0d8384dWEB
- https://github.com/spring-projects/spring-framework/commit/3f68cd633f03370d33c2603a6496e81273782601WEB
- https://github.com/spring-projects/spring-framework/commit/9beae9ae4226c45cd428035dae81214439324676WEB
- https://github.com/spring-projects/spring-framework/commit/9cef8e3001ddd61c734281a7556efd84b6cc2755WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan