CVE-2016-9878 Pivotal Spring Framework Paths provided to the ResourceServlet were not properly sanitized
HighCVSS 7.5
EPSS 4.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.springframework/spring-webmvc(Maven) | < 3.2.18 | 3.2.18 |
| org.springframework/spring-webmvc(Maven) | = 1.0 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 1.0-rc1 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 1.0.1 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 1.1 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 1.1-rc1 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 1.1-rc2 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 1.1.1 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 1.1.2 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 1.1.3 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 1.1.4 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 1.1.5 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 1.2 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 1.2-rc1 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 1.2-rc2 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 1.2.1 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 1.2.2 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 1.2.3 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 1.2.4 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 1.2.5 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 1.2.6 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 1.2.7 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 1.2.8 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 1.2.9 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 2.0 | No fix listed |
Show 107 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.springframework/spring-webmvc(Maven) | = 2.0-m1 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 2.0-m2 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 2.0-m3 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 2.0-m4 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 2.0-m5 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 2.0-rc1 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 2.0-rc2 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 2.0.1 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 2.0.2 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 2.0.3 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 2.0.4 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 2.0.5 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 2.0.6 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 2.0.7 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 2.0.8 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 2.5 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 2.5.1 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 2.5.2 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 2.5.3 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 2.5.4 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 2.5.5 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 2.5.6 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 2.5.6.SEC01 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 2.5.6.SEC02 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 2.5.6.SEC03 | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.0.0.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.0.1.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.0.2.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.0.3.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.0.4.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.0.5.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.0.6.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.0.7.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.1.0.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.1.1.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.1.2.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.1.3.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.1.4.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.2.0.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.2.1.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.2.10.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.2.11.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.2.12.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.2.13.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.2.14.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.2.15.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.2.16.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.2.17.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.2.2.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.2.3.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.2.4.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.2.5.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.2.6.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.2.7.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.2.8.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 3.2.9.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | >= 4.2.0, < 4.2.9 | 4.2.9 |
| org.springframework/spring-webmvc(Maven) | = 4.2.0.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 4.2.1.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 4.2.2.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 4.2.3.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 4.2.4.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 4.2.5.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 4.2.6.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 4.2.7.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 4.2.8.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | >= 4.3.0, < 4.3.5 | 4.3.5 |
| org.springframework/spring-webmvc(Maven) | = 4.3.0.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 4.3.1.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 4.3.2.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 4.3.3.RELEASE | No fix listed |
| org.springframework/spring-webmvc(Maven) | = 4.3.4.RELEASE | No fix listed |
| debian/libspring-java(Debian:12) | < 4.3.5-1 | 4.3.5-1 |
| debian/libspring-java(Debian:13) | < 4.3.5-1 | 4.3.5-1 |
| debian/libspring-java(Debian:14) | < 4.3.5-1 | 4.3.5-1 |
| pivotal software spring framework | <= 3.2.0 | No fix listed |
| pivotal software spring framework | = 4.2.0 | No fix listed |
| pivotal software spring framework | = 4.3.0 | No fix listed |
| VMware spring framework | = 3.2.1 | No fix listed |
| VMware spring framework | = 3.2.2 | No fix listed |
| VMware spring framework | = 3.2.3 | No fix listed |
| VMware spring framework | = 3.2.4 | No fix listed |
| VMware spring framework | = 3.2.5 | No fix listed |
| VMware spring framework | = 3.2.6 | No fix listed |
| VMware spring framework | = 3.2.7 | No fix listed |
| VMware spring framework | = 3.2.8 | No fix listed |
| VMware spring framework | = 3.2.9 | No fix listed |
| VMware spring framework | = 3.2.10 | No fix listed |
| VMware spring framework | = 3.2.11 | No fix listed |
| VMware spring framework | = 3.2.12 | No fix listed |
| VMware spring framework | = 3.2.13 | No fix listed |
| VMware spring framework | = 3.2.14 | No fix listed |
| VMware spring framework | = 3.2.15 | No fix listed |
| VMware spring framework | = 3.2.16 | No fix listed |
| VMware spring framework | = 3.2.17 | No fix listed |
| VMware spring framework | = 4.2.1 | No fix listed |
| VMware spring framework | = 4.2.2 | No fix listed |
| VMware spring framework | = 4.2.3 | No fix listed |
| VMware spring framework | = 4.2.4 | No fix listed |
| VMware spring framework | = 4.2.5 | No fix listed |
| VMware spring framework | = 4.2.6 | No fix listed |
| VMware spring framework | = 4.2.7 | No fix listed |
| VMware spring framework | = 4.2.8 | No fix listed |
| VMware spring framework | = 4.3.1 | No fix listed |
| VMware spring framework | = 4.3.2 | No fix listed |
| VMware spring framework | = 4.3.3 | No fix listed |
| VMware spring framework | = 4.3.4 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com
- github.com patch
- github.com patch
- github.com patch
- RHSA-2017:3115 vendor-advisory
- github.com vendor-advisory
- github.com product
- [debian-lts-announce] 20190713 [SECURITY] [DLA 1853-1] libspring-java security update mailing-list
- pivotal.io vendor-advisory
- security.netapp.com
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.oracle.com
- 95072 third-party-advisory vdb-entry
- 1040698 vdb-entry
- Debian Security Tracker CVE-2016-9878 vendor-advisory
- bugs.debian.org issue-tracking