CVE-2024-38819
| Severity | 7.5 High CVSS 3.1 |
|---|---|
| Fixed in | 6.1.14 |
| Weakness | Path traversal (CWE-22) |
| Published | 19 Dec 2024 |
| Updated | 13 Nov 2026 |
Description
Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.
Exploitation status
Working exploit published
A reviewed exploit catalogue lists ready-to-run exploit code for this CVE.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: none
- Indexed PoC 4 indexed Published artifacts you can open, in GitHub PoC, Nuclei; first seen 2024-12-14.
- EPSS 56% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99% of all scored CVEs.
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | masa42/CVE-2024-38819-POC | 39 | 2024-12-14 |
| GitHub PoC | CVE-2024-38819 nuclei template | 3 | 2024-12-16 |
| GitHub PoC | vishalnoza/CVE-2024-38819-POC2 | 1 | 2025-06-25 |
| Nuclei | Spring Framework Path Traversal in Functional Web Frameworks |
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full Path traversal, Filesystem
- Action available security rule
- Review human Researcher
- Record active
| Decided by | A researcher's recorded decision for this specific CVE |
|---|---|
| Finding | A researcher found this CVE protected by the ARMR Filsesystem Path Traversal. |
Waratek research note
written 2026-11-13Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.
Comments
Rule Name: Filsesystem Path Traversal
Rule example
app("Path Traversal mod 4"):
requires(version: ARMR/2.8)
filesystem("Protect against relative and absolute path traversal attacks"):
input(deserialization, http, database)
traversal()
protect()
endfilesystem
endapp
How to mitigate CVE-2024-38819
Upgrade the affected software to 6.1.14 or later. Until you can, Waratek RASP blocks exploitation with its path traversal and filesystem rules. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update October 2025 ↗ | CPU | 2025-Q4 | Oracle Enterprise Manager / Infrastructure Management (Spring Framework) (13.5, 24.1) Oracle HealthCare Applications / FHIR Server (Spring Framework) (8.2.0.5) Oracle Systems / Core (Spring Framework) (4) |
| Oracle Critical Patch Update July 2025 ↗ | CPU | 2025-Q3 | Oracle Communications / Platform (Spring Framework) (24.2.0) Oracle Fusion Middleware / Centralized Thirdparty Jars (Spring Framework) (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0) Oracle HealthCare Applications / Master Index Data Manager (Spring Framework) (5.0.0.0-5.0.9.2) Oracle Retail Applications / RPAS Fusion Client (Spring Framework) (15.0.3,16.0.3) |
| Oracle Critical Patch Update April 2025 ↗ | CPU | 2025-Q2 | Oracle Commerce / Content Acquisition System (Spring Framework) (11.3.2, 11.4.0) Oracle Communications / Automated Test Suite (Spring Framework) (24.2.0) Oracle Communications / Internal Tools (Spring Framework) (9.1.1.9) Oracle Communications / Security (Spring Framework) (9.0.0, 9.0.1, 9.0.2, 9.0.3) Oracle Communications Applications / Core (Spring Framework) (6.0-6.1) Oracle Construction and Engineering / Document Management (Spring Framework) (22.12.0-22.12.15, 23.12.0-23.12.13, 24.12.0-24.12.3) Oracle Financial Services Applications / Platform (Spring Framework) (8.1.2.5, 8.1.1.4, 8.0.8.6, 8.0.7.8) Oracle Insurance Applications / Docupresentment IDS Server (Spring Framework) (12.7.1.6, 12.7.2.3, 13.0.0.1) |
| Oracle Critical Patch Update January 2025 ↗ | CPU | 2025-Q1 | Oracle Communications / Alarms, KPI, and Measurements (Spring Framework) (24.2.0-24.2.2) Oracle Communications / Install (Spring Framework) (24.2.0, 24.2.1) Oracle Communications / Install (Spring Framework) (24.3.0,24.2.3) Oracle Communications / Signaling (Spring Framework) (24.2.0, 24.2.1, 24.2.2) Oracle Enterprise Manager / EM Plugin: General (Spring Framework) (13.5.2.0.0) Oracle Financial Services Applications / Installer (Spring Framework) (8.1.3.0) Oracle Financial Services Applications / Platform (Spring Framework) (8.0.7.8, 8.0.8.6, 8.1.2.5) Oracle Financial Services Applications / Platform (Spring Framework) (8.0.8) Oracle Financial Services Applications / Platform (Spring Framework) (8.0.8.1, 8.1.2.7, 8.1.2.8) Oracle Financial Services Applications / Reports (Spring Framework) (8.1.2.6) Oracle Fusion Middleware / Installer (Spring Framework) (12.2.1.4.0) Oracle Fusion Middleware / Third Party (Spring Framework) (12.2.1.4.0) Oracle Retail Applications / PeopleSoft Integration Bugs (Spring Framework) (14.1.3.2, 15.0.3.1, 16.0.3.0, 19.0.1.0) Oracle Retail Applications / RIB Kernal (Spring Framework) (14.1.3.2, 15.0.3.1, 16.0.3.0, 19.0.1.0) Oracle Utilities Applications / Tools (Spring Framework) (6.0.0.1.0-6.0.0.3.0, 7.0.0.0.0-7.0.0.1.0) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Commerce | Content Acquisition System (Spring Framework) | 11.3.2, 11.4.0 | 11.3.2 · 11.4.0 |
| Oracle Communications | Alarms, KPI, and Measurements (Spring Framework) | 24.2.0-24.2.2 | |
| Oracle Communications | Automated Test Suite (Spring Framework) | 24.2.0 | 24.2.0 |
| Oracle Communications | Install (Spring Framework) | 24.2.0, 24.2.1 | 24.2.0 · 24.2.1 · 24.2.3 · 24.3.0 |
| Oracle Communications | Internal Tools (Spring Framework) | 9.1.1.9 | 9.1.1.9 |
| Oracle Communications | Platform (Spring Framework) | 24.2.0 | 24.2.0 |
| Oracle Communications | Security (Spring Framework) | 9.0.0, 9.0.1, 9.0.2, 9.0.3 | 9.0.0 · 9.0.1 · 9.0.2 · 9.0.3 |
| Oracle Communications | Signaling (Spring Framework) | 24.2.0, 24.2.1, 24.2.2 | 24.2.0 · 24.2.1 · 24.2.2 |
| Oracle Communications Applications | Core (Spring Framework) | 6.0-6.1 | |
| Oracle Construction and Engineering | Document Management (Spring Framework) | 22.12.0-22.12.15, 23.12.0-23.12.13, 24.12.0-24.12.3 | |
| Oracle Enterprise Manager | EM Plugin: General (Spring Framework) | 13.5.2.0.0 | 13.5.2.0.0 |
| Oracle Enterprise Manager | Infrastructure Management (Spring Framework) | 13.5, 24.1 | 13.5 · 24.1 |
| Oracle Financial Services Applications | Installer (Spring Framework) | 8.1.3.0 | 8.1.3.0 |
| Oracle Financial Services Applications | Platform (Spring Framework) | 8.1.2.5, 8.1.1.4, 8.0.8.6, 8.0.7.8 | 8.0.7.8 · 8.0.8 · 8.0.8.1 · 8.0.8.6 · 8.1.1.4 · 8.1.2.5 · 8.1.2.7 · 8.1.2.8 |
| Oracle Financial Services Applications | Reports (Spring Framework) | 8.1.2.6 | 8.1.2.6 |
| Oracle Fusion Middleware | Centralized Thirdparty Jars (Spring Framework) | 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 | 12.2.1.4.0 · 14.1.1.0.0 · 14.1.2.0.0 |
| Oracle Fusion Middleware | Installer (Spring Framework) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Fusion Middleware | Third Party (Spring Framework) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle HealthCare Applications | FHIR Server (Spring Framework) | 8.2.0.5 | 8.2.0.5 |
| Oracle HealthCare Applications | Master Index Data Manager (Spring Framework) | 5.0.0.0-5.0.9.2 | |
| Oracle Insurance Applications | Docupresentment IDS Server (Spring Framework) | 12.7.1.6, 12.7.2.3, 13.0.0.1 | 12.7.1.6 · 12.7.2.3 · 13.0.0.1 |
| Oracle Retail Applications | PeopleSoft Integration Bugs (Spring Framework) | 14.1.3.2, 15.0.3.1, 16.0.3.0, 19.0.1.0 | 14.1.3.2 · 15.0.3.1 · 16.0.3.0 · 19.0.1.0 |
| Oracle Retail Applications | RIB Kernal (Spring Framework) | 14.1.3.2, 15.0.3.1, 16.0.3.0, 19.0.1.0 | 14.1.3.2 · 15.0.3.1 · 16.0.3.0 · 19.0.1.0 |
| Oracle Retail Applications | RPAS Fusion Client (Spring Framework) | 15.0.3,16.0.3 | 15.0.3 · 16.0.3 |
| Oracle Systems | Core (Spring Framework) | 4 | 4 |
| Oracle Utilities Applications | Tools (Spring Framework) | 6.0.0.1.0-6.0.0.3.0, 7.0.0.0.0-7.0.0.1.0 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.springframework:spring-webflux |
6.1.0 | 6.1.14 |
unbounded |
org.springframework:spring-webmvc |
6.1.0 | 6.1.14 |
unbounded |
org.springframework:spring-webflux |
0 | none | 5.3.40 |
org.springframework:spring-webmvc |
0 | none | 5.3.40 |
org.springframework:spring-webflux |
6.0.0 | none | 6.0.24 |
org.springframework:spring-webmvc |
6.0.0 | none | 6.0.24 |
Products and versions
2 products, 6 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| osv | org.springframework | spring-webflux | generic | ≤ 5.3.40 · ≥ 6.0.0 and ≤ 6.0.24 · ≥ 6.1.0 and ＜ 6.1.14 |
| osv | org.springframework | spring-webmvc | generic | ≤ 5.3.40 · ≥ 6.0.0 and ≤ 6.0.24 · ≥ 6.1.0 and ＜ 6.1.14 |
References
Timeline
Timeline
| Published | 2024-12-19 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |
| Classification created | 2026-11-13 | First commit adding this CVE's research note. |
| Last VRT activity | 2026-11-13 | Most recent commit touching this CVE's classification, patch or rule file. |