Spring Framework, versions 5.0 before 5.0.5 and versions 4.3 before 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
vmware spring framework |
||
oracle retail xstore point of service 7.1 |
||
oracle enterprise manager ops center 12.2.2 |
||
oracle primavera gateway 16.2 |
||
oracle primavera gateway 15.2 |
||
oracle application testing suite 12.5.0.3 |
||
oracle retail back office 14.1 |
||
oracle retail back office 14.0 |
||
oracle enterprise manager ops center 12.3.3 |
||
oracle retail open commerce platform 6.0.1 |
||
oracle application testing suite 13.1.0.1 |
||
oracle application testing suite 13.2.0.1 |
||
oracle application testing suite 13.3.0.1 |
||
oracle communications diameter signaling router |
||
oracle communications performance intelligence center |
||
oracle communications services gatekeeper |
||
oracle health sciences information manager 3.0 |
||
oracle healthcare master person index 3.0 |
||
oracle healthcare master person index 4.0 |
||
oracle insurance calculation engine 10.2 |
||
oracle insurance rules palette 10.0 |
||
oracle insurance rules palette 10.2 |
||
oracle retail customer insights 15.0 |
||
oracle retail customer insights 16.0 |
||
oracle tape library acsls 8.4 |
||
oracle communications converged application server |
||
oracle service architecture leveraging tuxedo 12.1.3.0.0 |
||
oracle service architecture leveraging tuxedo 12.2.2.0.0 |
||
oracle big data discovery 1.6.0 |
||
oracle goldengate for big data 12.2.0.1 |
||
oracle goldengate for big data 12.3.1.1 |
||
oracle goldengate for big data 12.3.2.1 |
||
oracle insurance calculation engine 10.1.1 |
||
oracle insurance calculation engine 10.2.1 |
||
oracle insurance rules palette 10.1 |
||
oracle insurance rules palette 11.0 |
||
oracle insurance rules palette 11.1 |
||
oracle primavera gateway 17.12 |
||
oracle retail integration bus 14.0.1 |
||
oracle retail integration bus 14.0.2 |
||
oracle retail integration bus 14.0.3 |
||
oracle retail integration bus 14.0.4 |
||
oracle retail integration bus 14.1.1 |
||
oracle retail integration bus 14.1.2 |
||
oracle retail integration bus 14.1.3 |
||
oracle retail integration bus 15.0.0.1 |
||
oracle retail integration bus 15.0.1 |
||
oracle retail integration bus 15.0.2 |
||
oracle retail integration bus 16.0 |
||
oracle retail integration bus 16.0.1 |
||
oracle retail integration bus 16.0.2 |
||
oracle retail open commerce platform 5.3.0 |
||
oracle retail open commerce platform 6.0.0 |
||
oracle retail order broker 5.1 |
||
oracle retail order broker 5.2 |
||
oracle retail order broker 15.0 |
||
oracle retail order broker 16.0 |
||
oracle retail predictive application server 14.0 |
||
oracle retail predictive application server 14.1 |
||
oracle retail predictive application server 15.0 |
||
oracle retail predictive application server 16.0 |
||
oracle retail point-of-sale 14.0 |
||
oracle retail returns management 14.0 |
||
oracle retail returns management 14.1 |
||
oracle communications policy management 12.5.0 |
||
oracle insurance calculation engine |
||
oracle rapid planning 12.1 |
||
oracle rapid planning 12.2 |
||
oracle retail central office 14.0 |
||
oracle retail central office 14.1 |
||
oracle retail point-of-sale 14.1 |
Vulmon