Unscored severity · published Nov 20, 2014
CVE-2014-3625
Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read…
–
CVSS
9.9%
EPSS
No
On KEV
Description
Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling.
Exploitation
Is it being used?
Exploit prediction (EPSS)9.9% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SF
Spring Framework · Pivotal Software
3.1.0 through 3.1.4; 3.2.0 before 3.2.12; 4.0.0 before 4.0.8; 4.1.0 before 4.1.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3625
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3625
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-0236.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-0720.html
Vendor Advisory
http://www.pivotal.io/security/cve-2014-3625
Third Party Advisory
https://jira.spring.io/browse/SPR-12354
lists.debian.org
https://lists.debian.org/debian-lts-announce/2019/07/msg00012.html
More from Spring Framework
8.8
CVE-2014-0225
When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the…
7.5
CVE-2016-5007
Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers…
7.5
CVE-2016-9878
An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5
5.5
CVE-2015-3192
Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to…
5.4
CVE-2013-6430
The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which…