CVE-2018-1271CWE-22

CVE-2018-1271: falha em Spring Framework

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Spring Framework+ Monitorar org.springframework:spring-core

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

30Vexday Risk Score

Corrija em breve. Ela tem exploit funcional público.

ssvc Attendepss 30%
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.
Produtos afetados
Spring by Pivotal · Spring Framework
CVEs relacionadas — Spring Framework

No mesmo produto, das mais perigosas para as menos.

CVE-2018-1273CRITICALCVE-2018-1273EPSS 97.0%KEVCVE-2018-1270—CVE-2018-1270EPSS 77.6%CVE-2018-1275—CVE-2018-1275EPSS 57.7%CVE-2018-1272—CVE-2018-1272EPSS 3.1%CVE-2018-1274—CVE-2018-1274EPSS 1.9%