NetSight
IP …
high7.5

CVE-2016-9878

An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5.

Impact

An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks.

Affected products

VendorProductAffected versions
Pivotal SoftwareSpring Framework
through 3.2.0
Versions 4.2.0, 4.3.0
VmwareSpring Framework
Versions 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.2.5, 3.2.6

Weakness classification

CWE-22

References