GHSA-pgf9-h69p-pcgf

Source

https://github.com/advisories/GHSA-pgf9-h69p-pcgf

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-pgf9-h69p-pcgf/GHSA-pgf9-h69p-pcgf.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-pgf9-h69p-pcgf

Aliases

CVE-2015-5211

Published

2018-10-17T20:29:33Z

Modified

2024-03-05T18:16:14.318775Z

Severity

8.6 (High) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS Calculator

Summary

Files or Directories Accessible to External Parties in org.springframework:spring-core

Details

Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being downloaded rather than rendered and also includes some input reflected in the response.

Database specific

{
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-20",
        "CWE-552"
    ],
    "severity": "HIGH",
    "github_reviewed_at": "2020-06-16T21:49:06Z",
    "nvd_published_at": "2017-05-25T17:29:00Z"
}

References

Affected packages

Maven / org.springframework:spring-core

Package

Name: org.springframework:spring-core; View open source insights on deps.dev
Purl: pkg:maven/org.springframework/spring-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.2.0

Fixed

4.2.2

Affected versions

4.*

4.2.0.RELEASE

4.2.1.RELEASE

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-pgf9-h69p-pcgf/GHSA-pgf9-h69p-pcgf.json"

Maven / org.springframework:spring-core

Package

Name: org.springframework:spring-core; View open source insights on deps.dev
Purl: pkg:maven/org.springframework/spring-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.0.0

Fixed

4.1.8

Affected versions

4.*

4.0.0.RELEASE

4.0.1.RELEASE

4.0.2.RELEASE

4.0.3.RELEASE

4.0.4.RELEASE

4.0.5.RELEASE

4.0.6.RELEASE

4.0.7.RELEASE

4.0.8.RELEASE

4.0.9.RELEASE

4.1.0.RELEASE

4.1.1.RELEASE

4.1.2.RELEASE

4.1.3.RELEASE

4.1.4.RELEASE

4.1.5.RELEASE

4.1.6.RELEASE

4.1.7.RELEASE

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-pgf9-h69p-pcgf/GHSA-pgf9-h69p-pcgf.json"

Maven / org.springframework:spring-core

Package

Name: org.springframework:spring-core; View open source insights on deps.dev
Purl: pkg:maven/org.springframework/spring-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.2.15

Affected versions

1.*

1.0-rc1

1.0

1.0.1

1.1-rc1

1.1-rc2

1.1

1.1.1

1.1.2

1.1.3

1.1.4

1.1.5

1.2-rc1

1.2-rc2

1.2

1.2.1

1.2.2

1.2.3

1.2.4

1.2.5

1.2.6

1.2.7

1.2.8

1.2.9

2.*

2.0-m1

2.0-m2

2.0-m3

2.0-m4

2.0-m5

2.0-rc1

2.0-rc2

2.0

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.0.8

2.5

2.5.1

2.5.2

2.5.3

2.5.4

2.5.5

2.5.6

2.5.6.SEC01

2.5.6.SEC02

2.5.6.SEC03

3.*

3.0.0.RELEASE

3.0.1.RELEASE

3.0.2.RELEASE

3.0.3.RELEASE

3.0.4.RELEASE

3.0.5.RELEASE

3.0.6.RELEASE

3.0.7.RELEASE

3.1.0.RELEASE

3.1.1.RELEASE

3.1.2.RELEASE

3.1.3.RELEASE

3.1.4.RELEASE

3.2.0.RELEASE

3.2.1.RELEASE

3.2.2.RELEASE

3.2.3.RELEASE

3.2.4.RELEASE

3.2.5.RELEASE

3.2.6.RELEASE

3.2.7.RELEASE

3.2.8.RELEASE

3.2.9.RELEASE

3.2.10.RELEASE

3.2.11.RELEASE

3.2.12.RELEASE

3.2.13.RELEASE

3.2.14.RELEASE

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-pgf9-h69p-pcgf/GHSA-pgf9-h69p-pcgf.json"