org.springframework:spring-webmvc 6.2.16 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the org.springframework:spring-webmvc package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Directory Traversal org.springframework:spring-webmvc is a package that provides Model-View-Controller (MVC) architecture and ready components that can be used to develop flexible and loosely coupled web applications. Affected versions of this package are vulnerable to Directory Traversal via the Script View Templates. An attacker can access sensitive file contents outside of the intended directories by leveraging the Java scripting engine in template rendering. Note: This is only exploitable if the application has a mapping for `"/**"` that results in view rendering, and where the view name is not explicitly specified. How to fix Directory Traversal? Upgrade `org.springframework:spring-webmvc` to version 6.2.17, 7.0.6 or higher.	[,6.2.17)[7.0.0-M1,7.0.6)
L Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') org.springframework:spring-webmvc is a package that provides Model-View-Controller (MVC) architecture and ready components that can be used to develop flexible and loosely coupled web applications. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'). The vulnerability exists in the handling of Server-Sent Events (SSE) when streaming plain text data. An attacker can inject crafted data into the event stream, breaking message boundaries and corrupting the stream delivered to other clients. By controlling streamed content, an attacker can manipulate how subsequent events are parsed by the client, potentially altering application state or injecting misleading data. Note: This is only exploitable if the application streams attacker-controlled data via SSE using unstructured/plain-text messages instead of a structured format (e.g., JSON). How to fix Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')? Upgrade `org.springframework:spring-webmvc` to version 6.2.17, 7.0.6 or higher.	[,6.2.17)[7.0.0,7.0.6)

Vulnerability

Vulnerable Version

Directory Traversal

org.springframework:spring-webmvc is a package that provides Model-View-Controller (MVC) architecture and ready components that can be used to develop flexible and loosely coupled web applications.

Affected versions of this package are vulnerable to Directory Traversal via the Script View Templates. An attacker can access sensitive file contents outside of the intended directories by leveraging the Java scripting engine in template rendering.

Note:

This is only exploitable if the application has a mapping for "/**" that results in view rendering, and where the view name is not explicitly specified.

How to fix Directory Traversal?

Upgrade org.springframework:spring-webmvc to version 6.2.17, 7.0.6 or higher.

[,6.2.17)[7.0.0-M1,7.0.6)

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

org.springframework:spring-webmvc is a package that provides Model-View-Controller (MVC) architecture and ready components that can be used to develop flexible and loosely coupled web applications.

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'). The vulnerability exists in the handling of Server-Sent Events (SSE) when streaming plain text data. An attacker can inject crafted data into the event stream, breaking message boundaries and corrupting the stream delivered to other clients. By controlling streamed content, an attacker can manipulate how subsequent events are parsed by the client, potentially altering application state or injecting misleading data.

Note:

This is only exploitable if the application streams attacker-controlled data via SSE using unstructured/plain-text messages instead of a structured format (e.g., JSON).

How to fix Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')?

Upgrade org.springframework:spring-webmvc to version 6.2.17, 7.0.6 or higher.

[,6.2.17)[7.0.0,7.0.6)

org.springframework:spring-webmvc@6.2.16 vulnerabilities

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically