An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• pivotal software spring frameworkup to 3.2.0 inclusive
• pivotal software spring framework4.2.0
• pivotal software spring framework4.3.0
• vmware spring framework3.2.1
• vmware spring framework3.2.10
• vmware spring framework3.2.11
• vmware spring framework3.2.12
• vmware spring framework3.2.13
• vmware spring framework3.2.14
• vmware spring framework3.2.15
• vmware spring framework3.2.16
• vmware spring framework3.2.17
• vmware spring framework3.2.2
• vmware spring framework3.2.3
• vmware spring framework3.2.4
• vmware spring framework3.2.5
• vmware spring framework3.2.6
• vmware spring framework3.2.7
• vmware spring framework3.2.8
• vmware spring framework3.2.9

Versions reported by the vendor

Affected version ranges reported by the assigning authority (dell). Independent of NVD's CPE analysis and usually ahead of it.

• n/a Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5

  • Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5affected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2013-6429The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entit
  54Plan
• CVE-2014-0225When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions
  36Monitor
• CVE-2016-5007Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization
  31Monitor
• CVE-2015-3192Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disable
  23Monitor
• CVE-2014-3625Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2
  23Monitor
• CVE-2013-6430The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properl
  22Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A user-supplied file name is joined with the allowed directory, but the result is never checked to confirm it is still inside that directory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const file = path.join(ROOT, req.query.name);2res.sendFile(file);

1const file = path.resolve(ROOT, req.query.name);2if (!file.startsWith(ROOT + path.sep)) {3  return res.sendStatus(400);4}5res.sendFile(file);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.