CVE-2014-3625

Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://jira.spring.io/browse/SPR-12354	Third Party Advisory
http://www.pivotal.io/security/cve-2014-3625	Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-0236.html	Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-0720.html	Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/07/msg00012.html

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:vmware:spring_framework::::::::
	cpe:2.3:a:pivotal_software:spring_framework::::::::
	cpe:2.3:a:pivotal_software:spring_framework::::::::
	cpe:2.3:a:pivotal_software:spring_framework::::::::
	cpe:2.3:a:pivotal_software:spring_framework::::::::

Information

Published : 2014-11-20 09:50

Updated : 2022-04-11 10:16

NVD link : CVE-2014-3625

Mitre link : CVE-2014-3625

JSON object : View

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Products Affected

pivotal_software

spring_framework

vmware

spring_framework

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://jira.spring.io/browse/SPR-12354", "name": "https://jira.spring.io/browse/SPR-12354", "tags": ["Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "http://www.pivotal.io/security/cve-2014-3625", "name": "http://www.pivotal.io/security/cve-2014-3625", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://rhn.redhat.com/errata/RHSA-2015-0236.html", "name": "RHSA-2015:0236", "tags": ["Third Party Advisory"], "refsource": "REDHAT"}, {"url": "http://rhn.redhat.com/errata/RHSA-2015-0720.html", "name": "RHSA-2015:0720", "tags": ["Third Party Advisory"], "refsource": "REDHAT"}, {"url": "https://lists.debian.org/debian-lts-announce/2019/07/msg00012.html", "name": "[debian-lts-announce] 20190713 [SECURITY] [DLA 1853-1] libspring-java security update", "tags": [], "refsource": "MLIST"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-22"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2014-3625", "ASSIGNER": "secalert@redhat.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "acInsufInfo": true, "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2014-11-20T17:50Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "3.0.7", "versionStartIncluding": "3.0.4"}, {"cpe23Uri": "cpe:2.3:a:pivotal_software:spring_framework:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "3.1.4", "versionStartIncluding": "3.1.0"}, {"cpe23Uri": "cpe:2.3:a:pivotal_software:spring_framework:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "3.2.12", "versionStartIncluding": "3.2.0"}, {"cpe23Uri": "cpe:2.3:a:pivotal_software:spring_framework:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "4.0.8", "versionStartIncluding": "4.0.0"}, {"cpe23Uri": "cpe:2.3:a:pivotal_software:spring_framework:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "4.1.2", "versionStartIncluding": "4.1.0"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2022-04-11T17:16Z"}

5.0 /10