CVE-2018-1271 Path Traversal in org.springframework:spring-core
MediumCVSS 5.9
EPSS 30.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.springframework/spring-core(Maven) | >= 5.0.0, < 5.0.5 | 5.0.5 |
| org.springframework/spring-core(Maven) | = 5.0.0.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 5.0.1.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 5.0.2.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 5.0.3.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 5.0.4.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | < 4.3.15 | 4.3.15 |
| org.springframework/spring-core(Maven) | = 1.0 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.0-rc1 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.0.1 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.1 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.1-rc1 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.1-rc2 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.1.1 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.1.2 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.1.3 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.1.4 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.1.5 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.2 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.2-rc1 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.2-rc2 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.2.1 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.2.2 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.2.3 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.2.4 | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.springframework/spring-core(Maven) | = 1.2.5 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.2.6 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.2.7 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.2.8 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.2.9 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0-m1 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0-m2 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0-m3 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0-m4 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0-m5 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0-rc1 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0-rc2 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0.1 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0.2 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0.3 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0.4 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0.5 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0.6 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0.7 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0.8 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.5 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.5.1 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.5.2 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.5.3 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.5.4 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.5.5 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.5.6 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.5.6.SEC01 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.5.6.SEC02 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.5.6.SEC03 | No fix listed |
| org.springframework/spring-core(Maven) | = 3.0.0.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.0.1.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.0.2.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.0.3.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.0.4.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.0.5.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.0.6.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.0.7.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.1.0.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.1.1.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.1.2.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.1.3.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.1.4.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.0.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.1.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.10.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.11.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.12.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.13.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.14.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.15.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.16.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.17.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.18.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.2.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.3.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.4.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.5.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.6.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.7.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.8.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.9.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.0.0.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.0.1.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.0.2.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.0.3.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.0.4.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.0.5.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.0.6.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.0.7.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.0.8.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.0.9.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.1.0.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.1.1.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.1.2.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.1.3.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.1.4.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.1.5.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.1.6.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.1.7.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.1.8.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.1.9.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.2.0.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.2.1.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.2.2.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.2.3.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.2.4.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.2.5.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.2.6.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.2.7.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.2.8.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.2.9.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.0.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.1.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.10.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.11.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.12.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.13.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.14.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.2.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.3.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.4.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.5.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.6.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.7.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.8.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.9.RELEASE | No fix listed |
| VMware spring framework | >= 4.3.0, < 4.3.15 | 4.3.15 |
| VMware spring framework | >= 5.0.0, < 5.0.5 | 5.0.5 |
| oracle application testing suite | = 12.5.0.3 | No fix listed |
| oracle application testing suite | = 13.1.0.1 | No fix listed |
| oracle application testing suite | = 13.2.0.1 | No fix listed |
| oracle application testing suite | = 13.3.0.1 | No fix listed |
| oracle big data discovery | = 1.6.0 | No fix listed |
| oracle communications converged application server | < 7.0.0.1 | 7.0.0.1 |
| oracle communications diameter signaling router | < 8.3 | 8.3 |
| oracle communications performance intelligence center | < 10.2.1 | 10.2.1 |
| oracle communications policy management | = 12.5.0 | No fix listed |
| oracle communications services gatekeeper | < 6.1.0.4.0 | 6.1.0.4.0 |
| oracle enterprise manager ops center | = 12.2.2 | No fix listed |
| oracle enterprise manager ops center | = 12.3.3 | No fix listed |
| oracle goldengate for big data | = 12.2.0.1 | No fix listed |
| oracle goldengate for big data | = 12.3.1.1 | No fix listed |
| oracle goldengate for big data | = 12.3.2.1 | No fix listed |
| oracle health sciences information manager | = 3.0 | No fix listed |
| oracle healthcare master person index | = 3.0 | No fix listed |
| oracle healthcare master person index | = 4.0 | No fix listed |
| oracle insurance calculation engine | >= 11.0.0, <= 11.3.1 | No fix listed |
| oracle insurance calculation engine | = 10.1.1 | No fix listed |
| oracle insurance calculation engine | = 10.2 | No fix listed |
| oracle insurance calculation engine | = 10.2.1 | No fix listed |
| oracle insurance rules palette | = 10.0 | No fix listed |
| oracle insurance rules palette | = 10.1 | No fix listed |
| oracle insurance rules palette | = 10.2 | No fix listed |
| oracle insurance rules palette | = 11.0 | No fix listed |
| oracle insurance rules palette | = 11.1 | No fix listed |
| oracle primavera gateway | = 15.2 | No fix listed |
| oracle primavera gateway | = 16.2 | No fix listed |
| oracle primavera gateway | = 17.12 | No fix listed |
| oracle rapid planning | = 12.1 | No fix listed |
| oracle rapid planning | = 12.2 | No fix listed |
| oracle retail back office | = 14.0 | No fix listed |
| oracle retail back office | = 14.1 | No fix listed |
| oracle retail central office | = 14.0 | No fix listed |
| oracle retail central office | = 14.1 | No fix listed |
| oracle retail customer insights | = 15.0 | No fix listed |
| oracle retail customer insights | = 16.0 | No fix listed |
| oracle retail integration bus | = 14.0.1 | No fix listed |
| oracle retail integration bus | = 14.0.2 | No fix listed |
| oracle retail integration bus | = 14.0.3 | No fix listed |
| oracle retail integration bus | = 14.0.4 | No fix listed |
| oracle retail integration bus | = 14.1.1 | No fix listed |
| oracle retail integration bus | = 14.1.2 | No fix listed |
| oracle retail integration bus | = 14.1.3 | No fix listed |
| oracle retail integration bus | = 15.0.0.1 | No fix listed |
| oracle retail integration bus | = 15.0.1 | No fix listed |
| oracle retail integration bus | = 15.0.2 | No fix listed |
| oracle retail integration bus | = 16.0 | No fix listed |
| oracle retail integration bus | = 16.0.1 | No fix listed |
| oracle retail integration bus | = 16.0.2 | No fix listed |
| oracle retail open commerce platform | = 5.3.0 | No fix listed |
| oracle retail open commerce platform | = 6.0.0 | No fix listed |
| oracle retail open commerce platform | = 6.0.1 | No fix listed |
| oracle retail order broker | = 5.1 | No fix listed |
| oracle retail order broker | = 5.2 | No fix listed |
| oracle retail order broker | = 15.0 | No fix listed |
| oracle retail order broker | = 16.0 | No fix listed |
| oracle retail point-of-sale | = 14.0 | No fix listed |
| oracle retail point-of-sale | = 14.1 | No fix listed |
| oracle retail predictive application server | = 14.0 | No fix listed |
| oracle retail predictive application server | = 14.1 | No fix listed |
| oracle retail predictive application server | = 15.0 | No fix listed |
| oracle retail predictive application server | = 16.0 | No fix listed |
| oracle retail returns management | = 14.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory
- pivotal.io vendor-advisory
- github.com vendor-advisory
- RHSA-2018:2939 third-party-advisory vendor-advisory
- RHSA-2018:2669 third-party-advisory vendor-advisory
- RHSA-2018:1320 third-party-advisory vendor-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- 103699 third-party-advisory vdb-entry
- Debian Security Tracker CVE-2018-1271 vendor-advisory