|
Vulnerabilities
< Back

CVE-2024-38819

Updated on 19 Dec 2024

Severity

7.5 High severity

Details

CVSS score
7.5
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.

Details

Affected product:
Apache Tomcat , Eclipse Jetty , Spring , activemq , camel , cocoon , cxf , jersey , taglibs-standard-impl , tika
Affected packages:
cxf-rt-rs-security-oauth2 @ 3.5.11 (+2434 more)
Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.

Fixes