WaratekVRT Sign in

Medium org.springframework spring-webmvc CVEs

13 CVEs, 5 protected by Waratek

Reset
More filters (2)
Columns
Vendor org.springframework✕Product spring-webmvc✕
Overview 13 matches · 5 protected · 0 exploited · 0 CISA KEV · 2 public PoC · 1 EPSS ≥ 0.5
13matches 5protected38.5% 0exploited0.0% 0CISA KEV0.0% 2public PoC15.4% 1EPSS ≥ 0.57.7%
Protected by Waratek 5 38.5% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 8 61.5%
Critical 0 0.0% High 0 0.0% Medium 13 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 5 38.5% partly blocked 0 0.0% not blocked 8 61.5% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 7.7% Proof of concept only 1 7.7% Forecast only 1 7.7% No public exploit 10 76.9%
split by peak 7 / year
No exploit published: 8Protected by Waratek: 5 Medium: 13 not blocked: 8blocked by ARMR today: 5 No public exploit: 10Forecast only: 1Proof of concept only: 1Working exploit published: 1
20143 Protected by Waratek2 No exploit published1 Medium3 blocked by ARMR today2 not blocked1 Proof of concept only1 Forecast only1 No public exploit1 20150 20160 20170 20180 20190 20201 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20210 20220 20230 20241 No exploit published1 Medium1 not blocked1 No public exploit1 20251 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1 20267 Protected by Waratek1 No exploit published6 Medium7 blocked by ARMR today1 not blocked6 No public exploit7
2014201620182020202220242026
13 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-41853 Medium 2026-06-09 No exploit published No public exploit Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
CVE-2026-41846 Medium 2026-06-09 No exploit published No public exploit Spring MVC applications which accept user-supplied values in the cssClass, cssErrorClass, or cssStyle attributes of JSP form tags allow arbitrary HTML/JavaScript code injection, potentially resulting in a cross-site scripting (XSS) vulnerability. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
CVE-2026-41844 Medium 2026-06-09 No exploit published No public exploit A Spring MVC or Spring WebFlux application which configures a mapping for "/**" where the view name is not explicitly specified allows an attacker to craft a link resulting in a 302 redirect to an arbitrary external host via the redirect: prefix. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
CVE-2026-41843 Medium 2026-06-09 Protected by Waratek No public exploit Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
CVE-2026-41841 Medium 2026-06-09 No exploit published No public exploit Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
CVE-2026-22745 Medium 2026-04-29 No exploit published No public exploit Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources. More precisely, an application can be vulnerable when all the following are true: * the application is using Spring MVC or Spring WebFlux * the application is serving static resources from the file system * the application is running on a Windows platform When all the conditions above are met, the attacker can send malicious requests that are slow to resolve and that can keep HTTP connections in use. This can cause a Denial of Service on the application.
CVE-2026-22737 Medium 2026-03-20 No exploit published No public exploit Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from files outside the configured locations for script template views. This issue affects Spring Framework: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.
CVE-2025-41242 Medium 2025-08-18 Protected by Waratek Working exploit published Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: * the application is deployed as a WAR or with an embedded Servlet container * the Servlet container does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization * the application serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title  with Spring resource handling We have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.
CVE-2024-38828 Medium 2024-11-18 No exploit published No public exploit Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack.
CVE-2020-5397 Medium 2020-01-17 Protected by Waratek No public exploit Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not include credentials and therefore requests should fail authentication. However a notable exception to this are Chrome based browsers when using client certificates for authentication since Chrome sends TLS client certificates in CORS preflight requests in violation of spec requirements. No HTTP body can be sent or received as a result of this attack.
CVE-2014-3625 Medium 2014-11-20 Protected by Waratek Proof of concept only Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling.
CVE-2014-0054 Medium 2014-04-17 Protected by Waratek Forecast only The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
CVE-2014-1904 Medium 2014-03-20 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.