GHSA-gfwj-fwqj-fp3v

Suggest an improvement
Source
https://github.com/advisories/GHSA-gfwj-fwqj-fp3v
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-gfwj-fwqj-fp3v/GHSA-gfwj-fwqj-fp3v.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-gfwj-fwqj-fp3v
Aliases
Published
2022-05-24T19:03:28Z
Modified
2024-02-20T05:32:02.209050Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Improper Privilege Management in Spring Framework
Details

In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.

Database specific 
{
    "nvd_published_at": "2021-05-27T15:15:00Z",
    "cwe_ids": [
        "CWE-269",
        "CWE-668"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-22T18:24:11Z"
}
References

Affected packages

Maven / org.springframework:spring-web

Package

Name
org.springframework:spring-web
View open source insights on deps.dev
Purl
pkg:maven/org.springframework/spring-web

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.2.0
Fixed
5.2.15

Affected versions

5.*

5.2.0.RELEASE
5.2.1.RELEASE
5.2.2.RELEASE
5.2.3.RELEASE
5.2.4.RELEASE
5.2.5.RELEASE
5.2.6.RELEASE
5.2.7.RELEASE
5.2.8.RELEASE
5.2.9.RELEASE
5.2.10.RELEASE
5.2.11.RELEASE
5.2.12.RELEASE
5.2.13.RELEASE
5.2.14.RELEASE

Database specific 

{
    "last_known_affected_version_range": "<= 5.2.14"
}

Maven / org.springframework:spring-web

Package

Name
org.springframework:spring-web
View open source insights on deps.dev
Purl
pkg:maven/org.springframework/spring-web

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.3.0
Fixed
5.3.7

Affected versions

5.*

5.3.0
5.3.1
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6

Database specific 

{
    "last_known_affected_version_range": "<= 5.3.6"
}