CVE-2018-1271: Path Traversal

Published Apr 6, 2018
·
Updated

Pivotal Spring Framework could allow a remote attacker to traverse directories on the system, caused by improper validation of user request. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to configure Spring MVC to serve static resources.

Other sources

Spring Framework versions 5.0 to 5.0.4, 4.3 to 4.3.14, and older unsupported versions allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.

This vulnerability does not affect applications that use versions of Spring Security patched for CVE-2018-1199.

External Reference:

https://pivotal.io/security/cve-2018-1271

Red Hat

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.

GitHub

Affected Software

77 affected componentsFixes available
redhat/springframework<5.05
5.05
redhat/springframework<4.3.15
4.3.15
maven/org.springframework:spring-core<4.3.15
4.3.15
maven/org.springframework:spring-core>=5.0.0<5.0.5
5.0.5
VMware Spring Framework>=4.3.0<4.3.15
VMware Spring Framework>=5.0.0<5.0.5
Oracle Application Testing Suite=12.5.0.3
Oracle Application Testing Suite=13.1.0.1
Oracle Application Testing Suite=13.2.0.1
Oracle Application Testing Suite=13.3.0.1
Oracle Big Data Discovery=1.6.0
Oracle Communications Converged Application Server<7.0.0.1
Oracle Communications Diameter Signaling Router<8.3
Oracle Communications Performance Intelligence Center<10.2.1
Oracle Communications Policy Management=12.5.0
Oracle Communications Services Gatekeeper<6.1.0.4.0
Oracle Enterprise Manager Ops Center=12.2.2
Oracle Enterprise Manager Ops Center=12.3.3
Oracle Goldengate For Big Data=12.2.0.1
Oracle Goldengate For Big Data=12.3.1.1
Oracle Goldengate For Big Data=12.3.2.1
Oracle Health Sciences Information Manager=3.0
Oracle Healthcare Master Person Index=3.0
Oracle Healthcare Master Person Index=4.0
Oracle Insurance Calculation Engine>=11.0.0<=11.3.1
Oracle Insurance Calculation Engine=10.1.1
Oracle Insurance Calculation Engine=10.2
Oracle Insurance Calculation Engine=10.2.1
Oracle Insurance Rules Palette=10.0
Oracle Insurance Rules Palette=10.1
Oracle Insurance Rules Palette=10.2
Oracle Insurance Rules Palette=11.0
Oracle Insurance Rules Palette=11.1
Oracle Primavera Gateway=15.2
Oracle Primavera Gateway=16.2
Oracle Primavera Gateway=17.12
Oracle Rapid Planning=12.1
Oracle Rapid Planning=12.2
Oracle Retail Back Office=14.0
Oracle Retail Back Office=14.1
Oracle Retail Central Office=14.0
Oracle Retail Central Office=14.1
Oracle Retail Customer Insights=15.0
Oracle Retail Customer Insights=16.0
Oracle Retail Integration Bus=14.0.1
Oracle Retail Integration Bus=14.0.2
Oracle Retail Integration Bus=14.0.3
Oracle Retail Integration Bus=14.0.4
Oracle Retail Integration Bus=14.1.1
Oracle Retail Integration Bus=14.1.2
Oracle Retail Integration Bus=14.1.3
Oracle Retail Integration Bus=15.0.0.1
Oracle Retail Integration Bus=15.0.1
Oracle Retail Integration Bus=15.0.2
Oracle Retail Integration Bus=16.0
Oracle Retail Integration Bus=16.0.1
Oracle Retail Integration Bus=16.0.2
Oracle Retail Open Commerce Platform=5.3.0
Oracle Retail Open Commerce Platform=6.0.0
Oracle Retail Open Commerce Platform=6.0.1
Oracle Retail Order Broker=5.1
Oracle Retail Order Broker=5.2
Oracle Retail Order Broker=15.0
Oracle Retail Order Broker=16.0
Oracle Retail Point-of-sale=14.0
Oracle Retail Point-of-sale=14.1
Oracle Retail Predictive Application Server=14.0
Oracle Retail Predictive Application Server=14.1
Oracle Retail Predictive Application Server=15.0
Oracle Retail Predictive Application Server=16.0
Oracle Retail Returns Management=14.0
Oracle Retail Returns Management=14.1
Oracle Retail Xstore Point of Service=7.1
Oracle Service Architecture Leveraging Tuxedo=12.1.3.0.0
Oracle Service Architecture Leveraging Tuxedo=12.2.2.0.0
Oracle Tape Library Acsls=8.4
IBM GDE<=3.0.0.2

Event History

Apr 6, 2018
CVE Published
via MITRE·01:00 PM
Data Sourced
via MITRE·01:00 PM
DescriptionWeakness
Apr 24, 2018
Data Sourced
via Red Hat·02:38 AM
DescriptionSeverityAffected Software
Oct 17, 2018
Advisory Published
via GitHub·08:07 PM

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2018-1271?

CVE-2018-1271 has been designated a high severity vulnerability.

2

How do I fix CVE-2018-1271?

To fix CVE-2018-1271, upgrade to Spring Framework versions 4.3.15 or 5.0.5.

3

Who is affected by CVE-2018-1271?

CVE-2018-1271 affects users of the Pivotal Spring Framework prior to versions 4.3.15 and 5.0.5.

4

What is the impact of CVE-2018-1271?

CVE-2018-1271 could allow a remote attacker to perform directory traversal attacks.

5

Is CVE-2018-1271 related to any specific software?

Yes, CVE-2018-1271 is specifically related to the Pivotal Spring Framework.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203