CVE-2024-38819CWE-22

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks

High · published December 19, 2024

Patch now

High probability of exploitation

CVSS calls it high at 7.5. It sits in the 99.0th percentile for exploit probability.

CVSS v3.1
7.5
EPSS
56%
Percentile
99.0
In the wild
Unconfirmed
What it is

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.56040 · 99.0th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2024-12-19T17:15Z
EPSS history
Timeline
  • 19 DEC 17:15Z
    Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks
    cvelistv5