Vulnerability Description
An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Pivotal Software | Spring Framework | <= 3.2.0 |
| Vmware | Spring Framework | 3.2.1 |
Related Weaknesses (CWE)
References
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.securityfocus.com/bid/95072Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1040698
- https://access.redhat.com/errata/RHSA-2017:3115
- https://lists.debian.org/debian-lts-announce/2019/07/msg00012.html
- https://pivotal.io/security/cve-2016-9878Vendor Advisory
- https://security.netapp.com/advisory/ntap-20180419-0002/
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.securityfocus.com/bid/95072Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1040698
FAQ
What is CVE-2016-9878?
CVE-2016-9878 is a vulnerability with a CVSS score of 7.5 (HIGH). An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. Paths provided to the ResourceServlet were not properly sanitized and as a result exposed...
How severe is CVE-2016-9878?
CVE-2016-9878 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-9878?
Check the references section above for vendor advisories and patch information. Affected products include: Pivotal Software Spring Framework, Vmware Spring Framework.