CVE-2024-38816

🗓️ 13 Sep 2024 06:10:06Reported by vmwareType

cve🔗 web.nvd.nist.gov📰️ 7 Media mentions👁 615 Views🌐 WEB

Applications serving static resources through WebMvc.fn or WebFlux.fn can be exploited for path traversal attacks, allowing unauthorized access to the file system

Reporter	Title	Published	Views	Family All 209
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM DevOps Solution Workbench	30 Oct 202520:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a sensitive information exposure in VMware Tanzu Spring [CVE-2024-38816]	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Edge Application Manager	20 Aug 202502:37	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security vulnerabilities affecting IBM Knowledge Catalog Premium Cartridge	11 Mar 202619:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - AI Broker Component component uses spring-webmvc-6.1.12.jar which is vulnerable to this CVE-2024-38816	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services is vulnerable to spring-webmvc-6.1.12 (CVE-2024-38816)	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	15 Mar 202510:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities (CVE-2024-38816, CVE-2024-38808, CVE-2024-35952)	19 Jun 202505:35	–	ibm
IBM Security Bulletins	Security Bulletin: security vulnerabilities are addressed with IBM Business Automation Insights iFix for Junuary 2025.	7 Feb 202518:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in spring-webflux-5.3.27.jar	8 Jul 202506:43	–	ibm

Vulnrichment

Node

spring_by_vmware_tanzu spring_frameworkMatch5.3.0

spring_by_vmware_tanzu spring_frameworkMatch6.0.0

spring_by_vmware_tanzu spring_frameworkMatch6.1.0

[
  {
    "defaultStatus": "affected",
    "packageName": "Spring Framework",
    "product": "Spring",
    "vendor": "Spring",
    "versions": [
      {
        "lessThan": "5.3.40",
        "status": "affected",
        "version": "5.3.x",
        "versionType": "enterprise Support Only"
      },
      {
        "lessThan": "6.0.24",
        "status": "affected",
        "version": "6.0.x",
        "versionType": "enterprise Support Only"
      },
      {
        "lessThan": "6.1.13",
        "status": "affected",
        "version": "6.1.x",
        "versionType": "OSS"
      }
    ]
  }
]

Source	Link
spring	www.spring.io/security/cve-2024-38816
security	www.security.netapp.com/advisory/ntap-20241227-0001/

Parameter	Position	Path	Description	CWE
path	path	/static/link/%2e%2e/etc/passwd	Path traversal via RouterFunctions.resources with FileSystemResource; PoC attempts to read /etc/passwd using encoded traversal in the path.	CWE-22

17 Jun 2026 07:41Current

7High risk

Vulners AI Score7

CVSS 3.17.5

EPSS0.14718

SSVC