CVE-2018-1271

    Dashboard / Vulnerabilities / CVE-2018-1271

    CVE-2018-1271

    Published: 6 Apr 2018Last Modified: 8 Jul 2026

    Summary:

    Details: Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.

    References: http://www.securityfocus.com/bid/103699, https://access.redhat.com/errata/RHSA-2018:1320, https://access.redhat.com/errata/RHSA-2018:2669, https://access.redhat.com/errata/RHSA-2018:2939, https://pivotal.io/security/cve-2018-1271, https://www.oracle.com/security-alerts/cpujul2020.html, https://www.oracle.com/security-alerts/cpuoct2021.html, http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html, http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html, https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html, https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- b49d801f241fb8088a5b7514db93fda32c58731c
    Fixed -89932891ec67df1f716e65f09826f2647baf2f17

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High