CVE-2018-1271CWE-22

CVE-2018-1271: vulnerability in Spring Framework

Published · Updated

Follow this CVE+ Monitor Spring Framework+ Monitor org.springframework:spring-core

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

30Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 30%
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.
Affected products
Spring by Pivotal · Spring Framework
Related CVEs — Spring Framework

In the same product, most dangerous first.

CVE-2018-1273CRITICALCVE-2018-1273EPSS 97.0%KEVCVE-2018-1270—CVE-2018-1270EPSS 77.6%CVE-2018-1275—CVE-2018-1275EPSS 57.7%CVE-2018-1272—CVE-2018-1272EPSS 3.1%CVE-2018-1274—CVE-2018-1274EPSS 1.9%