Files or Directories Accessible to External Parties in org.springframework:spring-core
High severity
GitHub Reviewed
Published
Oct 17, 2018
to the GitHub Advisory Database
•
Updated Mar 15, 2024
Package
Affected versions
>= 4.0.0, < 4.1.8
>= 4.2.0, < 4.2.2
< 3.2.15
Patched versions
4.1.8
4.2.2
3.2.15
Description
Published by the National Vulnerability Database
May 25, 2017
Published to the GitHub Advisory Database
Oct 17, 2018
Reviewed
Jun 16, 2020
Last updated
Mar 15, 2024
Credits
-
sunSUNQ Analyst
Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being downloaded rather than rendered and also includes some input reflected in the response.
References