CVE-2014-3578 Improper Limitation of a Pathname to a Restricted Directory in Spring Framework
MediumCVSS 5.0
EPSS 6.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in Pivotal Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5 allows remote attackers to read arbitrary files via a crafted URL.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.springframework/spring-core(Maven) | >= 3.0.0, < 3.2.9 | 3.2.9 |
| org.springframework/spring-core(Maven) | = 3.0.0.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.0.1.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.0.2.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.0.3.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.0.4.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.0.5.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.0.6.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.0.7.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.1.0.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.1.1.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.1.2.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.1.3.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.1.4.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.0.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.1.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.2.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.3.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.4.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.5.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.6.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.7.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.8.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | >= 4.0.0, < 4.0.5 | 4.0.5 |
| org.springframework/spring-core(Maven) | = 4.0.0.RELEASE | No fix listed |
Show 9 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.springframework/spring-core(Maven) | = 4.0.1.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.0.2.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.0.3.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.0.4.RELEASE | No fix listed |
| debian/libspring-java(Debian:12) | < 3.2.13-1 | 3.2.13-1 |
| debian/libspring-java(Debian:13) | < 3.2.13-1 | 3.2.13-1 |
| debian/libspring-java(Debian:14) | < 3.2.13-1 | 3.2.13-1 |
| pivotal software spring framework | >= 3.2.0, < 3.2.9 | 3.2.9 |
| pivotal software spring framework | >= 4.0.0, < 4.0.5 | 4.0.5 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com
- github.com patch
- github.com patch
- github.com patch
- bugzilla.redhat.com issue-tracking third-party-advisory
- github.com product
- [debian-lts-announce] 20190713 [SECURITY] [DLA 1853-1] libspring-java security update mailing-list
- RHSA-2015:0234 third-party-advisory vendor-advisory
- RHSA-2015:0235 third-party-advisory vendor-advisory
- JVN#49154900 third-party-advisory vdb-entry
- JVNDB-2014-000054 third-party-advisory vdb-entry
- pivotal.io vendor-advisory
- RHSA-2015:0720 third-party-advisory vendor-advisory
- github.com
- Debian Security Tracker CVE-2014-3578 vendor-advisory
- 68042 third-party-advisory vdb-entry
- bugs.debian.org issue-tracking