CVE-2024-38816
| Severity | 7.5 High CVSS 3.1 |
|---|---|
| Fixed in | 6.1.13 |
| Weakness | Path traversal (CWE-22) |
| Published | 13 Sep 2024 |
| Updated | 17 Jun 2026 |
Description
Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running. Specifically, an application is vulnerable when both of the following are true: * the web application uses RouterFunctions to serve static resources * resource handling is explicitly configured with a FileSystemResource location However, malicious requests are blocked and rejected when any of the following is true: * the Spring Security HTTP Firewall https://docs.spring.io/spring-security/reference/servlet/exploits/firewall.html is in use * the application runs on Tomcat or Jetty
Exploitation status
Exploited
Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV listed Exploitation reported in the wild. 2 citations · 1 exploit · earliest 2024-10-22.
- CISA Vulnrichment exploitation: none
- Indexed PoC 6 indexed Published artifacts you can open, in GitHub PoC, Nuclei; first seen 2024-09-20.
- EPSS 21% chance in 30 days A model's forecast, not a report of exploitation. Higher than 98% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2024-38816 in VulnCheck (free account).
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Reported exploitation | cyble.com | /blog/cyble-sensors-detect-attacks-on-java-framework-iot-devices | 2024-10-22 |
| Reported exploitation | app.crowdsec.net | /cti/cve-explorer/CVE-2024-38816 | 2025-06-07 |
| Exploit reference | VulnCheck XDB 802a28ccc80c | Exploit type: infoleak | 2024-09-28 |
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | CVE-2024-38816 Proof of Concept | 9 | 2024-09-28 |
| GitHub PoC | startsw1th/cve-2024-38816-demo | 2 | 2024-09-20 |
| GitHub PoC | Fork spring-webmvc 5.3.39 to fix CVE-2024-38816, CVE-2024-38819 | 2025-04-14 | |
| GitHub PoC | Fixed cve-2024-38816 based on version 5.3.39 | 2025-01-02 | |
| GitHub PoC | CVE-2024-38816 | 2024-12-02 | |
| Nuclei | WebMvc.fn/WebFlux.fn - Path Traversal |
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full
- Action available security rule
- Review human Researcher
- Record active
| Decided by | Manual classification of this CVE in the legacy dataset |
|---|---|
| Finding | A manual classification set this CVE's status to Protected by Waratek. |
How to mitigate CVE-2024-38816
Upgrade the affected software to 6.1.13 or later. Until you can, Waratek RASP blocks exploitation with a security rule that blocks this kind of attack. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update April 2025 ↗ | CPU | 2025-Q2 | Oracle Communications / Automated Test Suite (Spring Framework) (24.2.0) Oracle Communications / Internal Tools (Spring Framework) (9.1.1.9) Oracle Financial Services Applications / Infrastructure (Spring Framework) (14.7.0.7.0) |
| Oracle Critical Patch Update January 2025 ↗ | CPU | 2025-Q1 | Oracle Communications / Alarms, KPI, and Measurements (Spring Framework) (24.2.0-24.2.2) Oracle Communications / Install (Spring Framework) (24.2.0, 24.2.1) Oracle Communications / Install (Spring Framework) (24.3.0, 24.2.3) Oracle Communications / Signaling (Spring Framework) (24.2.0, 24.2.1, 24.2.2) Oracle Fusion Middleware / Installer (Spring Framework) (12.2.1.4.0) Oracle Fusion Middleware / Third Party (Spring Framework) (12.2.1.4.0) |
| Oracle Critical Patch Update October 2024 ↗ | CPU | 2024-Q4 | Oracle Communications / Configuration (Spring Framework) (24.1.0, 24.2.0) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Communications | Alarms, KPI, and Measurements (Spring Framework) | 24.2.0-24.2.2 | |
| Oracle Communications | Automated Test Suite (Spring Framework) | 24.2.0 | 24.2.0 |
| Oracle Communications | Configuration (Spring Framework) | 24.1.0, 24.2.0 | 24.1.0 · 24.2.0 |
| Oracle Communications | Install (Spring Framework) | 24.2.0, 24.2.1 | 24.2.0 · 24.2.1 · 24.2.3 · 24.3.0 |
| Oracle Communications | Internal Tools (Spring Framework) | 9.1.1.9 | 9.1.1.9 |
| Oracle Communications | Signaling (Spring Framework) | 24.2.0, 24.2.1, 24.2.2 | 24.2.0 · 24.2.1 · 24.2.2 |
| Oracle Financial Services Applications | Infrastructure (Spring Framework) | 14.7.0.7.0 | 14.7.0.7.0 |
| Oracle Fusion Middleware | Installer (Spring Framework) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Fusion Middleware | Third Party (Spring Framework) | 12.2.1.4.0 | 12.2.1.4.0 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.springframework:spring-webmvc |
6.1.0 | 6.1.13 |
unbounded |
org.springframework:spring-webflux |
6.1.0 | 6.1.13 |
unbounded |
org.springframework:spring-webmvc |
6.0.0 | none | 6.0.23 |
org.springframework:spring-webflux |
6.0.0 | none | 6.0.23 |
org.springframework:spring-webmvc |
5.3.0 | none | 5.3.39 |
org.springframework:spring-webflux |
5.3.0 | none | 5.3.39 |
Products and versions
2 products, 6 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| osv | org.springframework | spring-webflux | generic | ≥ 5.3.0 and ≤ 5.3.39 · ≥ 6.0.0 and ≤ 6.0.23 · ≥ 6.1.0 and ＜ 6.1.13 |
| osv | org.springframework | spring-webmvc | generic | ≥ 5.3.0 and ≤ 5.3.39 · ≥ 6.0.0 and ≤ 6.0.23 · ≥ 6.1.0 and ＜ 6.1.13 |
References
Timeline
Timeline
| Published | 2024-09-13 | By the CVE Program. |
|---|---|---|
| VulnCheck KEV: earliest evidence | 2024-10-22 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| VulnCheck KEV: latest evidence | 2025-06-07 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |