Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: dell
Published: 2018-04-06T13:00:00Z
Updated: 2024-09-16T23:16:43.841Z
Reserved: 2017-12-06T00:00:00
Link: CVE-2018-1271
Vulnrichment
No data.
NVD
Status : Modified
Published: 2018-04-06T13:29:00.500
Modified: 2024-11-21T03:59:30.683
Link: CVE-2018-1271
Redhat