CVE-2024-38819: high-severity vulnerability in Spring Framework
Published · Updated
48Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 7.5epss 56%
exploitation probability
56%top 1% of all CVEs
observed exploitation
nono source reports it
What the vendors declare (VEX)
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Red HatVEX document ↗
Affected
7 products
Red Hat AMQ Broker 7 · Red Hat Build of Keycloak · Red Hat Data Grid 8 · Red Hat Fuse 7 · Red Hat Integration Camel K 1 · and others 2
workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Fixed
Not affected
8 products — because the vulnerable code is not present in the product
A-MQ Clients 2 · Red Hat JBoss Data Grid 7 · Red Hat JBoss Enterprise Application Platform 7 · Red Hat JBoss Enterprise Application Platform 8 · Red Hat JBoss Enterprise Application Platform Expansion Pack · and others 3
Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
N/A · Spring Framework