CyberSecBulletin

Spring Framework vulnerabilities

We track 2 vulnerabilities in Spring Framework products. 2 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on December 19, 2024.

2vulnerabilities
1critical
1high
1exploited
8.7average CVSS score

Latest Spring Framework vulnerabilities

  • 7.5 High severity

    Spring Framework: Improper Limitation of a Pathname to a Restricted Directory

    CVE-2024-38819Spring FrameworkEPSS 56.5%

    Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the pr

  • 9.8 Critical severity

    Spring Framework JDK 9+ Remote Code Execution Exploited

    CVE-2022-22965Spring FrameworkEPSS 99.6%

    A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot