Directory Traversal Vulnerability in Pivotal Spring Framework (CVE-2016-9878)
Summary
CVE-2016-9878: An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. Affects libspring-java across 33 version ranges.
< 0edb85c78b5844a42525705bec2901b773f844c2
< 1e727d65772327b5d89d89e4825e44484b6dd681
< 2f9c99e5cfc97e1b8958520b5155aed06d441202
< 4.3.5-1
< 5b99ee299031d331da9d4cc393ff1c24e0c8d63b
< 8b293e1be40b949b8de5d6ff7411c11416fe3d5a
< 8d6636aab1c2ae892bff33fe66341eda4017cbb6
< 015e1bec649d84d146b04e0062723c88e350e1b2
< 22a14c02c2fad2f7338bb66a759f325f17089612
< 022f1c335755a00d947540fc307741b419bfe9ac
< 28d43f886c5e387dbb496e850782274ec9176160
< 30aecf3cc56c568e89e46cac0d87f280c07a847c
< 62b8f97f0f50b1e3a930c23aa313ca10aa48498f
< 75bf620ae7df0967965a02e54e01f47ea5fa6f8c
< 77c0292665bc5e61d0e5108f9cd7e066381f28d3
< 137dc19fcdeee5a5edc230b39d2cc47f01624df7
< 201b2d752efc4c79b0d52d90e95dac1093520d5f
< 234cb84e832da30b6f53ccca4ef28043aacfcecc
< 330ba990490286f0d871120e44f0b9297adf0825
< 7482cf902106db2bff9e912cb67bdeea3adf5855
< 90718ef0d958759527fa7066a7149d8151664dda
< 58587159f08a5349801671b486cd781baa63cb9f
< 345570109ae2dbdafe05a4270f0c710b7d53d050
< a1efe4f35d067b93d6ff4b3850ae9b9d6d6f6e26
< a88b80195aedb70d3c351abeba8e6a0a93af339e
< abdcefb460fcbc1348ef04505a78381a2c69a643
< b49d801f241fb8088a5b7514db93fda32c58731c
< d111af1b88b53f2589d017a7cb6d068464d9bf77
< d802e2826a85a50b302f3da6770e6583822e2db8
< dd42a21f3968c165af924310fce460694803756f
< e3e2272a755a53863276850eb80dd5032f3cf571
< f440f927198c8b4959c727aec80e9b7423a4f548
< fc73f6bb2c2a65fadb4a7720af95bf9850733e60
Fixed in 4.3.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Pivotal Spring Framework is a powerful framework for building Java applications, providing comprehensive infrastructure support for developing Java applications. It offers features such as dependency injection, aspect-oriented programming, and transaction management. However, certain versions of the framework are vulnerable to directory traversal attacks, which can expose sensitive files and directories to unauthorized users.
Vulnerability Detail
CVE-2016-9878 is a directory traversal vulnerability found in Pivotal Spring Framework versions prior to 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. The vulnerability arises from improper sanitization of paths provided to the ResourceServlet, allowing attackers to manipulate file paths and access files outside the intended directory. This could lead to exposure of sensitive information, potentially compromising the security of the application and its data.
How To Fix
Minimum fixed version
4.3.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libspring-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not possible, consider implementing input validation and sanitization for file paths in your application to mitigate the risk of directory traversal attacks. Additionally, restrict access to sensitive directories and files through proper server configuration.
Conclusion
CVE-2016-9878 is a significant vulnerability in the Pivotal Spring Framework that can lead to directory traversal attacks. It is crucial for users of affected versions to update to the latest secure versions to protect their applications from potential exploitation. Implementing proper input validation and server configurations can also help mitigate risks.
See every vulnerability recorded for libspring-java →
FAQ
CVE-2016-9878 is a vulnerability in the Pivotal Spring Framework that allows for directory traversal attacks due to improper path sanitization.
Versions before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5 are affected by this vulnerability.
The main risk is unauthorized access to sensitive files and directories, which could lead to data breaches and compromise application security.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2016-9878 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for libspring-java.
