CVE-2018-9159 Moderate severity vulnerability that affects com.sparkjava:spark-core
MediumCVSS 5.3
EPSS 4.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Spark before 2.7.2, a remote attacker can read unintended static files via various representations of absolute or relative pathnames, as demonstrated by file: URLs and directory traversal sequences. NOTE: this product is unrelated to Ignite Realtime Spark.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| com.sparkjava/spark-core(Maven) | < 2.7.2 | 2.7.2 |
| com.sparkjava/spark-core(Maven) | = 1.0 | No fix listed |
| com.sparkjava/spark-core(Maven) | = 1.1 | No fix listed |
| com.sparkjava/spark-core(Maven) | = 1.1.1 | No fix listed |
| com.sparkjava/spark-core(Maven) | = 2.0.0 | No fix listed |
| com.sparkjava/spark-core(Maven) | = 2.1 | No fix listed |
| com.sparkjava/spark-core(Maven) | = 2.2 | No fix listed |
| com.sparkjava/spark-core(Maven) | = 2.3 | No fix listed |
| com.sparkjava/spark-core(Maven) | = 2.4 | No fix listed |
| com.sparkjava/spark-core(Maven) | = 2.5 | No fix listed |
| com.sparkjava/spark-core(Maven) | = 2.5.1 | No fix listed |
| com.sparkjava/spark-core(Maven) | = 2.5.2 | No fix listed |
| com.sparkjava/spark-core(Maven) | = 2.5.3 | No fix listed |
| com.sparkjava/spark-core(Maven) | = 2.5.4 | No fix listed |
| com.sparkjava/spark-core(Maven) | = 2.5.5 | No fix listed |
| com.sparkjava/spark-core(Maven) | = 2.6.0 | No fix listed |
| com.sparkjava/spark-core(Maven) | = 2.6.0.RC0 | No fix listed |
| com.sparkjava/spark-core(Maven) | = 2.7.0 | No fix listed |
| com.sparkjava/spark-core(Maven) | = 2.7.1 | No fix listed |
| sparkjava spark | < 2.7.2 | 2.7.2 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking third-party-advisory
- github.com patch third-party-advisory
- github.com patch third-party-advisory
- github.com patch third-party-advisory
- RHSA-2018:2020 third-party-advisory vendor-advisory
- RHSA-2018:2405 third-party-advisory vendor-advisory
- github.com vendor-advisory
- sparkjava.com vendor-advisory
- github.com product