{"id":"CVE-2014-3625","published":"2014-11-20T17:00:00Z","modified":"2024-08-06T10:50:17Z","title":"Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8…","vendor":null,"product":null,"tier":"tail","description":{"text":"Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.09928,"percentile":0.95573,"provenance":"source"},"cwes":[],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2015-0720.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.pivotal.io/security/cve-2014-3625","tags":["x_refsource_CONFIRM"]},{"url":"https://jira.spring.io/browse/SPR-12354","tags":["x_refsource_CONFIRM"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0236.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/07/msg00012.html","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":24.1,"factors":[{"name":"EPSS percentile","points":19.11},{"name":"Public exploit code","points":5.0}]},"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2016-02-03","earliestUrl":"https://github.com/ilmila/springcss-cve-2014-3625","repos":[{"name":"ilmila/springcss-cve-2014-3625","url":"https://github.com/ilmila/springcss-cve-2014-3625","stars":32,"created":"2016-02-03"},{"name":"gforresu/SpringPathTraversal","url":"https://github.com/gforresu/SpringPathTraversal","stars":0,"created":"2016-10-26"}]},"first":{"date":"2016-02-03","source":"PoC-in-GitHub","url":"https://github.com/ilmila/springcss-cve-2014-3625"},"provenance":"source"},"affected":[{"ecosystem":"Maven","package":"org.springframework:spring-webmvc","vulnerableRanges":[">=3.0.4, <3.2.12",">=4.0.0, <4.0.8",">=4.1.0, <4.1.2"],"patched":["3.2.12","4.0.8","4.1.2"],"from":["GHSA-hhm4-hwq6-3c6w"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-4158","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-spring-framework-cve-2014-3625","children":[{"from":"CVE-2014-3625","to":"CVE-2018-1271","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["spring-webmvc/src/main/java/org/springframework/web/servlet/resource/ResourceHttpRequestHandler.java"],"commits":["https://github.com/spring-projects/spring-framework/commit/161d3e3049f129e211f68a4e94b544e0f0d8384d","https://github.com/spring-projects/spring-framework/commit/3f68cd633f03370d33c2603a6496e81273782601","https://github.com/spring-projects/spring-framework/commit/0e28bee0f155b9bf240b4bafc4646e4810cb23f8","https://github.com/spring-projects/spring-framework/commit/13356a7ee2240f740737c5c83bdccdacc30603ab"],"basis":"shared function","functions":["getResource"]}]}],"packageHistory":[{"cve":"CVE-2014-0054","published":"2014-04-17","fixed":"4.0.2","kev":false},{"cve":"CVE-2014-1904","published":"2014-03-20","fixed":"4.0.2.RELEASE","kev":false,"link":{"from":"CVE-2014-1904","to":"CVE-2014-3625","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.springframework:spring-webmvc","fromFixed":"3.2.8.RELEASE","toFixed":"3.2.12","daysApart":245}]}},{"cve":"CVE-2014-0225","published":"2017-05-25","fixed":"4.0.5","kev":false},{"cve":"CVE-2014-3625","published":"2014-11-20","fixed":"4.1.2","kev":false},{"cve":"CVE-2016-9878","published":"2016-12-29","fixed":"4.3.5","kev":false},{"cve":"CVE-2020-5397","published":"2020-01-17","fixed":"5.2.3","kev":false},{"cve":"CVE-2020-5398","published":"2020-01-16","fixed":"5.2.3.RELEASE","kev":false}],"package":"Maven:org.springframework:spring-webmvc"}}