Fluid Attacks Database

Description

Spring Framework Path Traversal vulnerability Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
maven	org.springframework:spring-webmvc	>=6.1.0 <6.1.14 \|\| >=0 <=5.3.39 \|\| >=6.0.0 <=6.0.23	6.1.14
debian 11	libspring-java	=4.3.30-1 \|\| =4.3.30-2 \|\| =4.3.30-3 \|\| =4.3.30-4	-
debian 14	libspring-java	=4.3.30-3 \|\| =4.3.30-4	-
debian 13	libspring-java	=4.3.30-3 \|\| =4.3.30-4	-
debian 12	libspring-java	=4.3.30-2 \|\| =4.3.30-3 \|\| =4.3.30-4	-
maven	org.springframework:spring-webflux	>=6.1.0 <6.1.14 \|\| >=0 <=5.3.39 \|\| >=6.0.0 <=6.0.23	6.1.14

Aliases

1. CVE-2024-388192. NVD-2024-388193. OSV-2024-388194. OSV-DEBIAN-2024-388195. GCVE-2024-388196. SECURITY-TRACKER-CVE-2024-38819

References

1. https://github.com/spring-projects/spring-framework/issues/336892. https://github.com/spring-projects/spring-framework/commit/3bfbe30a7814c9ea1556d40df9bd87ddb3ba372d3. https://github.com/spring-projects/spring-framework/commit/fb7890d73975a3d9e0763e0926df2bd0a608e87e4. https://security.netapp.com/advisory/ntap-20250110-00105. https://spring.io/security/cve-2024-388196. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-38819.yaml7. https://github.com/masa42/CVE-2024-38819-POC

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.