CVE-2016-9177 Spark allows remote attackers to read arbitrary files via a .. (dot dot) in the URI
HighCVSS 7.5
EPSS 5.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in Spark 2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| com.sparkjava/spark-core(Maven) | < 2.5.2 | 2.5.2 |
| com.sparkjava/spark-core(Maven) | = 1.0 | No fix listed |
| com.sparkjava/spark-core(Maven) | = 1.1 | No fix listed |
| com.sparkjava/spark-core(Maven) | = 1.1.1 | No fix listed |
| com.sparkjava/spark-core(Maven) | = 2.0.0 | No fix listed |
| com.sparkjava/spark-core(Maven) | = 2.1 | No fix listed |
| com.sparkjava/spark-core(Maven) | = 2.2 | No fix listed |
| com.sparkjava/spark-core(Maven) | = 2.3 | No fix listed |
| com.sparkjava/spark-core(Maven) | = 2.4 | No fix listed |
| com.sparkjava/spark-core(Maven) | = 2.5 | No fix listed |
| com.sparkjava/spark-core(Maven) | = 2.5.1 | No fix listed |
| sparkjava spark | <= 2.5 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking patch third-party-advisory
- RHSA-2017:0868 vendor-advisory
- github.com vendor-advisory
- seclists.org exploit mailing-list third-party-advisory
- 94218 third-party-advisory vdb-entry
- github.com product