spring framework CVEs · Working exploit published

VRT Sign in

Look up CVE IDs Status Exploitation Severity

Reset

Overview 2 matches · 0 exploited · 0 CISA KEV · 1 EPSS ≥ 0.5

2matches 0exploited0.0% 0CISA KEV0.0% 1EPSS ≥ 0.550.0%

Protected by Waratek 2 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 0 0.0% Withdrawn CVE 0 0.0%

Critical 0 0.0% High 0 0.0% Medium 2 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 2 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 0 0.0% Working exploit published 2 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%

split by StatusSeverityProtectionExploit maturity peak 1 / year

20101 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1 20110 20120 20130 20140 20150 20160 20170 20181 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1

201020112012201320142015201620172018

2 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2018-1271	Medium	2018-04-06	Protected by Waratek	Working exploit published	Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.
CVE-2010-1622	Medium	2010-06-21	Protected by Waratek	Working exploit published	SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2018-1271

Medium

2018-04-06

Protected by Waratek

Working exploit published

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.

CVE-2010-1622

Medium

2010-06-21

Protected by Waratek

Working exploit published

SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.