Log in Start free

Vulnerability · Published Dec 19, 2024 · Assigned by vmware

CVE-2024-38819

High 7.5

In plain English

A high-severity path traversal in Spring Framework. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 56.5% (higher than 99.1% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)56.5%top 0.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling2Nuclei, Public PoC

Official description

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libspring-javano fix listedDEBIAN-CVE-2024-38819
Debian:13libspring-javano fix listedDEBIAN-CVE-2024-38819
Debian:14libspring-javano fix listedDEBIAN-CVE-2024-38819
Mavenorg.springframework:spring-webflux6.1.14GHSA-g5vr-rgqm-vf78
Mavenorg.springframework:spring-webfluxno fix listedGHSA-g5vr-rgqm-vf78
Mavenorg.springframework:spring-webfluxno fix listedGHSA-g5vr-rgqm-vf78
Mavenorg.springframework:spring-webmvcno fix listedGHSA-g5vr-rgqm-vf78
Mavenorg.springframework:spring-webmvcno fix listedGHSA-g5vr-rgqm-vf78
Mavenorg.springframework:spring-webmvc6.1.14GHSA-g5vr-rgqm-vf78
Ubuntu:25.10libspring-javano fix listedUBUNTU-CVE-2024-38819
Ubuntu:26.04:LTSlibspring-javano fix listedUBUNTU-CVE-2024-38819
Ubuntu:26.10libspring-javano fix listedUBUNTU-CVE-2024-38819

Affected products (as reported)

VendorProductVersions
N/A Spring Framework Spring Framework 5.3.0 - 5.3.40, 6.0.0 - 6.0.24, 6.1.0 - 6.1.13

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References