CVE-2018-1271 Security Details

CVE ID

CVE-2018-1271

CWE

CWE-22

CVE Description

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.

Published

Apr 9, 2018

CVSS Score & Severity

5.9Medium

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score

90.599%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/springframework/web/reactive/resource/ResourceWebHandler.processPath(Ljava/lang/String;)Ljava/lang/String;

JVMVulnerable params: 0

org/springframework/web/servlet/resource/ResourceHttpRequestHandler.getResource(Ljavax/servlet/http/HttpServletRequest;)Lorg/springframework/core/io/Resource;

JVMVulnerable params: 0

Affected Ecosystems

affected

Source

National Vulnerability Database

References

pivotal.ioPROJECT