org.springframework:spring-hibernate (1.2.2), org.springframework:spring-mock (1.2.2) +3 more potentially affected by CVE-2024-38820 via org.springframework:spring-web (1.2.2)

org.springframework:spring-web MAVEN version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.springframework:spring-hibernate 1.2.2 - org.springframework:spring-mock 1.2.2 -...

org.springframework:spring-hibernate (1.2.4), org.springframework:spring-mock (1.2.4) +3 more potentially affected by CVE-2024-38820 via org.springframework:spring-web (1.2.4)

org.springframework:spring-web MAVEN version 1.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.springframework:spring-hibernate 1.2.4 - org.springframework:spring-mock 1.2.4 -...

org.acegisecurity:acegi-security-cas (>=1.0.5, <=1.0.7), org.acegisecurity:acegi-security-samples-contacts (1.0.7) +4 more potentially affected by CVE-2024-38820 via org.springframework:spring-web (1.2.9)

org.springframework:spring-web MAVEN version 1.2.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.acegisecurity:acegi-security-cas =1.0.5, =1.0.7 -...

org.acegisecurity:acegi-security (>=1.0.0-rc2, <=1.0.0), org.acegisecurity:acegi-security-adapters (1.0.0) +13 more potentially affected by CVE-2024-38820 via org.springframework:spring-web (2.0-m2)

org.springframework:spring-web MAVEN version 2.0-m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.acegisecurity:acegi-security =1.0.0-rc2, =1.0.0-rc2, =1.0.0 - org.apache.pluto:pluto-portal...

org.springframework:spring-portlet (2.0.3), org.springframework:spring-remoting (2.0.3) +4 more potentially affected by CVE-2024-38820 via org.springframework:spring-web (2.0.3)

org.springframework:spring-web MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.springframework:spring-portlet 2.0.3 - org.springframework:spring-remoting 2.0.3 -...

org.springframework:spring-hibernate (1.2.1), org.springframework:spring-mock (1.2.1) +3 more potentially affected by CVE-2024-38820 via org.springframework:spring-web (1.2.1)

org.springframework:spring-web MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.springframework:spring-hibernate 1.2.1 - org.springframework:spring-mock 1.2.1 -...

org.springframework:spring-portlet (2.0-m1), org.springframework:spring-remoting (2.0-m1) +1 more potentially affected by CVE-2024-38820 via org.springframework:spring-web (2.0-m1)

org.springframework:spring-web MAVEN version 2.0-m1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.springframework:spring-portlet 2.0-m1 - org.springframework:spring-remoting 2.0-m1 -...

org.springframework:spring-hibernate (1.2.3), org.springframework:spring-mock (1.2.3) +3 more potentially affected by CVE-2024-38820 via org.springframework:spring-web (1.2.3)

org.springframework:spring-web MAVEN version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.springframework:spring-hibernate 1.2.3 - org.springframework:spring-mock 1.2.3 -...

africa.absa:inception-api (>=1.0.0, <=1.2.0), africa.absa:inception-codes-api (>=1.0.0, <=1.2.0) +11844 more potentially affected by CVE-2024-38820 via org.springframework:spring-webmvc (>=5.3.0, <=5.3.39)

org.springframework:spring-webmvc MAVEN version =5.3.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =4.4.0.2, =1.4.2, =1.6.6, =1.6.6.1 - ai.platon:distributed-lock-example 1.4.2 and more Source cves: CVE-2024-38820 Source advisory: MEND:CVE-2024-38820...

spring-webmvc: Path Traversal Vulnerability in Spring Applications Using RouterFunctions and FileSystemResource

A flaw was found in Spring applications using the WebMvc.fn or WebFlux.fn frameworks. This issue can allow attackers to perform path traversal attacks via crafted HTTP requests when the application serves static resources using RouterFunctions and explicitly configures resource handling with a...

org.acegisecurity:acegi-security-cas (>=1.0.5, <=1.0.7), org.acegisecurity:acegi-security-samples-contacts (1.0.7) +4 more potentially affected by CVE-2024-38809 via org.springframework:spring-web (1.2.9)

org.springframework:spring-web MAVEN version 1.2.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.acegisecurity:acegi-security-cas =1.0.5, =1.0.7 -...

org.springframework:spring-hibernate (1.2.3), org.springframework:spring-mock (1.2.3) +3 more potentially affected by CVE-2024-38809 via org.springframework:spring-web (1.2.3)

org.springframework:spring-web MAVEN version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.springframework:spring-hibernate 1.2.3 - org.springframework:spring-mock 1.2.3 -...

org.springframework:spring-hibernate (1.2.2), org.springframework:spring-mock (1.2.2) +3 more potentially affected by CVE-2024-38809 via org.springframework:spring-web (1.2.2)

org.springframework:spring-web MAVEN version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.springframework:spring-hibernate 1.2.2 - org.springframework:spring-mock 1.2.2 -...

com.evasion:client (>=1.0.0.1, <=1.0.0.3), org.grails:grails-webflow (>=2.2.0.rc1, <=2.2.5) +12 more potentially affected by CVE-2024-38809 via org.springframework:spring-web (2.5.6.sec01)

org.springframework:spring-web MAVEN version 2.5.6.sec01 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - com.evasion:client =1.0.0.1, =2.2.0.rc1, =2.0.2, =1.0.0.release, =2.0.8.release,...

org.springframework:spring-portlet (2.0.3), org.springframework:spring-remoting (2.0.3) +4 more potentially affected by CVE-2024-38809 via org.springframework:spring-web (2.0.3)

org.springframework:spring-web MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.springframework:spring-portlet 2.0.3 - org.springframework:spring-remoting 2.0.3 -...

CVE-2024-38816

A flaw was found in Spring applications using the WebMvc.fn or WebFlux.fn frameworks. This issue can allow attackers to perform path traversal attacks via crafted HTTP requests when the application serves static resources using RouterFunctions and explicitly configures resource handling with a...

africa.absa:inception-api (>=1.0.0, <=1.2.0), africa.absa:inception-codes-api (>=1.0.0, <=1.2.0) +11844 more potentially affected by CVE-2024-38816 via org.springframework:spring-webmvc (>=5.3.0, <=5.3.39)

org.springframework:spring-webmvc MAVEN version =5.3.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =4.4.0.2, =1.4.2, =1.6.6, =1.6.6.1 - ai.platon:distributed-lock-example 1.4.2 and more Source cves: CVE-2024-38816 Source advisory: OSV:GHSA-CX7F-G6MP-7HQM...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (0.2.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.1.0) +5125 more potentially affected by CVE-2024-38816 via org.springframework:spring-webmvc (>=6.1.0, <=6.1.12)

org.springframework:spring-webmvc MAVEN version =6.1.0, =0.0.4, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2024-38816 Source advisory: GHSA-CX7F-G6MP-7HQM...

africa.absa:inception-api (>=1.0.0, <=1.2.0), africa.absa:inception-codes-api (>=1.0.0, <=1.2.0) +11844 more potentially affected by CVE-2024-38816 via org.springframework:spring-webmvc (>=5.3.0, <=5.3.39)

org.springframework:spring-webmvc MAVEN version =5.3.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =4.4.0.2, =1.4.2, =1.6.6, =1.6.6.1 - ai.platon:distributed-lock-example 1.4.2 and more Source cves: CVE-2024-38816 Source advisory: GHSA-CX7F-G6MP-7HQM...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (0.2.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.1.0) +5125 more potentially affected by CVE-2024-38816 via org.springframework:spring-webmvc (>=6.1.0, <=6.1.12)

org.springframework:spring-webmvc MAVEN version =6.1.0, =0.0.4, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2024-38816 Source advisory: OSV:GHSA-CX7F-G6MP-7HQM...