WaratekVRT Sign in
Reset
More filters (3)
Columns
Published from 2024-01-01✕Published to 2024-12-31✕Vendor org.springframework✕
Overview 8 matches · 5 protected · 1 exploited · 0 CISA KEV · 2 public PoC · 1 EPSS ≥ 0.5
8matches 5protected62.5% 1exploited12.5% 0CISA KEV0.0% 2public PoC25.0% 1EPSS ≥ 0.512.5%
Protected by Waratek 5 62.5% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 3 37.5%
Critical 0 0.0% High 5 62.5% Medium 3 37.5% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 5 62.5% partly blocked 0 0.0% not blocked 3 37.5% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 12.5% Working exploit published 1 12.5% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 6 75.0%
split by peak 1 / month
No exploit published: 3Protected by Waratek: 5 Medium: 3High: 5 not blocked: 3blocked by ARMR today: 5 No public exploit: 6Working exploit published: 1Exploited: 1
Jan 241 No exploit published1 High1 not blocked1 No public exploit1 Feb 240 Mar 241 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 Apr 241 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 May 240 Jun 240 Jul 240 Aug 241 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 Sep 241 Protected by Waratek1 High1 blocked by ARMR today1 Exploited1 Oct 241 No exploit published1 Medium1 not blocked1 No public exploit1 Nov 241 No exploit published1 Medium1 not blocked1 No public exploit1 Dec 241 Protected by Waratek1 High1 blocked by ARMR today1 Working exploit published1
Jan 24Feb 24Mar 24Apr 24May 24Jun 24Jul 24Aug 24Sep 24Oct 24Nov 24Dec 24
8 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-38819 High 2024-12-19 Protected by Waratek Working exploit published Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.
CVE-2024-38828 Medium 2024-11-18 No exploit published No public exploit Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack.
CVE-2024-38820 Medium 2024-10-18 No exploit published No public exploit The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.
CVE-2024-38816 High 2024-09-13 Protected by Waratek Exploited Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running. Specifically, an application is vulnerable when both of the following are true: * the web application uses RouterFunctions to serve static resources * resource handling is explicitly configured with a FileSystemResource location However, malicious requests are blocked and rejected when any of the following is true: * the Spring Security HTTP Firewall https://docs.spring.io/spring-security/reference/servlet/exploits/firewall.html  is in use * the application runs on Tomcat or Jetty
CVE-2024-38808 Medium 2024-08-20 Protected by Waratek No public exploit In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. Specifically, an application is vulnerable when the following is true: * The application evaluates user-supplied SpEL expressions.
CVE-2024-22262 High 2024-04-16 Protected by Waratek No public exploit Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks. This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259  and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
CVE-2024-22259 High 2024-03-16 Protected by Waratek No public exploit Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks. This is the same as CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
CVE-2024-22233 High 2024-01-22 No exploit published No public exploit In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable when all of the following are true: * the application uses Spring MVC * Spring Security 6.1.6+ or 6.2.1+ is on the classpath Typically, Spring Boot applications need the org.springframework.boot:spring-boot-starter-web and org.springframework.boot:spring-boot-starter-security dependencies to meet all conditions.