Homepage

org.springframework:spring-beans@6.1.11 vulnerabilities

  • latest version

    6.2.10

  • latest non vulnerable version

    7.0.0-M8

  • first published

    19 years ago

  • latest version published

    1 months ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the org.springframework:spring-beans package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Relative Path Traversal

    org.springframework:spring-beans is a package that is the basis for Spring Framework's IoC container. The BeanFactory interface provides an advanced configuration mechanism capable of managing any type of object.

    Affected versions of this package are vulnerable to Relative Path Traversal when deployed on non-compliant Servlet containers. An unauthenticated attacker could gain access to files and directories outside the intended web root.

    Notes:

    1. This is only exploitable if the application is deployed as a WAR or with an embedded Servlet container, the Servlet container does not reject suspicious sequences and the application serves static resources with Spring resource handling.

    2. Applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration.

    3. This vulnerability was also fixed in the commercial versions 6.1.22 and 5.3.44.

    How to fix Relative Path Traversal?

    Upgrade org.springframework:spring-beans to version 6.2.10 or higher.

    [,6.2.10)
    Go back to all versions of this package