CVE-2018-1271: Path Traversal

First published: Fri Apr 06 2018(Updated: )

Pivotal Spring Framework could allow a remote attacker to traverse directories on the system, caused by improper validation of user request. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to configure Spring MVC to serve static resources.

Credit: security_alert@emc.com security_alert@emc.com

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/type
• agent/remedy
• agent/first-publish-date
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2018-1271
• agent/software-canonical-lookup
• agent/weakness
• agent/description
• collector/github-advisory-latest
• source/GitHub
• alias/GHSA-g8hw-794c-4j9g
• agent/severity
• agent/last-modified-date
• agent/event
• agent/author
• collector/github-advisory
• collector/nvd-cve
• source/NVD
• agent/software-canonical-lookup-request
• collector/nvd-index
• collector/ibm-support
• source/IBM
• agent/references
• agent/softwarecombine
• agent/tags
• collector/mitre-cve
• source/MITRE
• package-manager/redhat
• package-manager/maven
• vendor/vmware
• canonical/vmware spring framework
• version/vmware spring framework/4.3.0
• version/vmware spring framework/5.0.0
• vendor/oracle
• canonical/oracle application testing suite
• version/oracle application testing suite/12.5.0.3
• version/oracle application testing suite/13.1.0.1
• version/oracle application testing suite/13.2.0.1
• version/oracle application testing suite/13.3.0.1
• canonical/oracle big data discovery
• version/oracle big data discovery/1.6.0
• canonical/oracle communications converged application server
• canonical/oracle communications diameter signaling router
• canonical/oracle communications performance intelligence center
• canonical/oracle communications policy management
• version/oracle communications policy management/12.5.0
• canonical/oracle communications services gatekeeper
• canonical/oracle enterprise manager ops center
• version/oracle enterprise manager ops center/12.2.2
• version/oracle enterprise manager ops center/12.3.3
• canonical/oracle goldengate for big data
• version/oracle goldengate for big data/12.2.0.1
• version/oracle goldengate for big data/12.3.1.1
• version/oracle goldengate for big data/12.3.2.1
• canonical/oracle health sciences information manager
• version/oracle health sciences information manager/3.0
• canonical/oracle healthcare master person index
• version/oracle healthcare master person index/3.0
• version/oracle healthcare master person index/4.0
• canonical/oracle insurance calculation engine
• version/oracle insurance calculation engine/11.0.0
• version/oracle insurance calculation engine/11.3.1
• version/oracle insurance calculation engine/10.1.1
• version/oracle insurance calculation engine/10.2
• version/oracle insurance calculation engine/10.2.1
• canonical/oracle insurance rules palette
• version/oracle insurance rules palette/10.0
• version/oracle insurance rules palette/10.1
• version/oracle insurance rules palette/10.2
• version/oracle insurance rules palette/11.0
• version/oracle insurance rules palette/11.1
• canonical/oracle primavera gateway
• version/oracle primavera gateway/15.2
• version/oracle primavera gateway/16.2
• version/oracle primavera gateway/17.12
• canonical/oracle rapid planning
• version/oracle rapid planning/12.1
• version/oracle rapid planning/12.2
• canonical/oracle retail back office
• version/oracle retail back office/14.0
• version/oracle retail back office/14.1
• canonical/oracle retail central office
• version/oracle retail central office/14.0
• version/oracle retail central office/14.1
• canonical/oracle retail customer insights
• version/oracle retail customer insights/15.0
• version/oracle retail customer insights/16.0
• canonical/oracle retail integration bus
• version/oracle retail integration bus/14.0.1
• version/oracle retail integration bus/14.0.2
• version/oracle retail integration bus/14.0.3
• version/oracle retail integration bus/14.0.4
• version/oracle retail integration bus/14.1.1
• version/oracle retail integration bus/14.1.2
• version/oracle retail integration bus/14.1.3
• version/oracle retail integration bus/15.0.0.1
• version/oracle retail integration bus/15.0.1
• version/oracle retail integration bus/15.0.2
• version/oracle retail integration bus/16.0
• version/oracle retail integration bus/16.0.1
• version/oracle retail integration bus/16.0.2
• canonical/oracle retail open commerce platform
• version/oracle retail open commerce platform/5.3.0
• version/oracle retail open commerce platform/6.0.0
• version/oracle retail open commerce platform/6.0.1
• canonical/oracle retail order broker
• version/oracle retail order broker/5.1
• version/oracle retail order broker/5.2
• version/oracle retail order broker/15.0
• version/oracle retail order broker/16.0
• canonical/oracle retail point-of-sale
• version/oracle retail point-of-sale/14.0
• version/oracle retail point-of-sale/14.1
• canonical/oracle retail predictive application server
• version/oracle retail predictive application server/14.0
• version/oracle retail predictive application server/14.1
• version/oracle retail predictive application server/15.0
• version/oracle retail predictive application server/16.0
• canonical/oracle retail returns management
• version/oracle retail returns management/14.0
• version/oracle retail returns management/14.1
• canonical/oracle retail xstore point of service
• version/oracle retail xstore point of service/7.1
• canonical/oracle service architecture leveraging tuxedo
• version/oracle service architecture leveraging tuxedo/12.1.3.0.0
• version/oracle service architecture leveraging tuxedo/12.2.2.0.0
• canonical/oracle tape library acsls
• version/oracle tape library acsls/8.4
• vendor/ibm
• canonical/ibm gde
• version/ibm gde/3.0.0.2