Описание
Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources.
Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
A flaw was found in Spring MVC and WebFlux applications. A remote attacker could exploit this vulnerability by sending specially crafted requests when the application resolves static resources. This could lead to information disclosure, allowing the attacker to gain unauthorized access to sensitive data.
Отчет
This Moderate impact information disclosure vulnerability in Spring MVC and WebFlux applications arises from how static resources are resolved. Exploitation requires high attack complexity, limiting its immediate threat in typical Red Hat deployments. Successful attacks could lead to unauthorized access to sensitive data.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat build of Quarkus | quarkus-spring-webmvc-api | Fix deferred | ||
| Red Hat Enterprise Linux 8 | pki-core:10.6/resteasy | Fix deferred | ||
| Red Hat Enterprise Linux 8 | pki-deps:10.6/resteasy | Fix deferred | ||
| Red Hat Enterprise Linux 9 | resteasy | Fix deferred | ||
| Red Hat OpenShift Dev Spaces | devspaces/openvsx-rhel9 | Fix deferred | ||
| Red Hat OpenShift Dev Spaces | devspaces/pluginregistry-rhel9 | Fix deferred | ||
| Red Hat Single Sign-On 7 | spring-webmvc | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.9 Medium
CVSS3
Связанные уязвимости
Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Spring MVC and WebFlux applications are vulnerable to Information Disc ...
Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux
EPSS
5.9 Medium
CVSS3