Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.springframework:spring-webmvc

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

27 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5MavenPublished

    RFD attack via Content-Disposition header sourced from request input by Spring MVC or Spring WebFlux Application

    CVE-2020-5398 · GHSA-8wx2-9q48-vm9r

    Affected
    • Maven org.springframework:spring-webmvc >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE
    Fixed in
    5.1.13.RELEASE5.2.3.RELEASE5.0.16.RELEASE· Vendor fix available
    Issue
    In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.

    Recommended action: Upgrade to 5.2.3.RELEASE, 5.1.13.RELEASE or 5.0.16.RELEASE by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. High, CVSS 7.5MavenPublished

    Pivotal Spring Framework Paths provided to the ResourceServlet were not properly sanitized

    CVE-2016-9878 · GHSA-2m8h-fgr8-2q9w

    Affected
    • Maven org.springframework:spring-webmvc < 3.2.18; >= 4.2.0, < 4.2.9; >= 4.3.0, < 4.3.5
    Fixed in
    4.2.93.2.184.3.5· Vendor fix available
    Issue
    An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks.

    Recommended action: Upgrade to 4.3.5, 4.2.9 or 3.2.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →