{"id":"CVE-2024-38819","published":"2024-12-19T17:15:12Z","modified":"2025-01-10T13:06:45Z","title":"Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to…","vendor":null,"product":null,"tier":"core","eol":null,"affectedVersions":[{"vendor":"N/A","product":"Spring Framework","versions":["Spring Framework 5.3.0 - 5.3.40, 6.0.0 - 6.0.24, 6.1.0 - 6.1.13"]}],"description":{"text":"Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.","provenance":"source","from":"CVE.org"},"summary":{"text":"Applications built on the Spring Framework's functional web frameworks, WebMvc.fn or WebFlux.fn, that serve static resources contain a path traversal flaw in how those resources are handled. An unauthenticated remote attacker who can reach the application over the network can send crafted HTTP requests, with no user interaction or special configuration required, to read any file the Spring application's process can access on the file system.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:12:11Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.5604,"percentile":0.99046,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":5,"pulses":[{"name":"Actualización Oracle update - 20/07/2025","url":"https://otx.alienvault.com/pulse/687d031c402a7679a4673a5d","created":"2025-07-20"},{"name":"ACTUALIZACION | ||Oracle Critical Patch Update Advisory - April 2025","url":"https://otx.alienvault.com/pulse/6807e1c45dd52410facbed8f","created":"2025-04-22"},{"name":"ACTUALIZACION | SAP Security Patch Day - March 2025","url":"https://otx.alienvault.com/pulse/67ea97ff5aacbdc125ff5175","created":"2025-03-31"},{"name":"ACTUALIZACION | SAP Security Patch Day - March 2025","url":"https://otx.alienvault.com/pulse/67ea97fab81001ece19f54a1","created":"2025-03-31"},{"name":"Medusa Ransomware: A Growing Threat with a Bold Online Presence","url":"https://otx.alienvault.com/pulse/67508be45f644e4ae2a878d2","created":"2024-12-04"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://spring.io/security/cve-2024-38819","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20250110-0010/","tags":[]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.springframework:spring-webflux","vulnerableRanges":[">=6.1.0, <6.1.14","<=5.3.40",">=6.0.0, <=6.0.24"],"patched":["6.1.14"],"from":["GHSA-g5vr-rgqm-vf78"],"provenance":"source"},{"ecosystem":"Maven","package":"org.springframework:spring-webmvc","vulnerableRanges":[">=6.1.0, <6.1.14","<=5.3.40",">=6.0.0, <=6.0.24"],"patched":["6.1.14"],"from":["GHSA-g5vr-rgqm-vf78"],"provenance":"source"}],"advisories":[{"id":"GHSA-g5vr-rgqm-vf78","url":"https://github.com/advisories/GHSA-g5vr-rgqm-vf78","severity":"HIGH","ecosystem":"Maven","package":"org.springframework:spring-webflux","vulnerableRanges":[">=6.1.0, <6.1.14"],"patched":["6.1.14"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g5vr-rgqm-vf78","url":"https://github.com/advisories/GHSA-g5vr-rgqm-vf78","severity":"HIGH","ecosystem":"Maven","package":"org.springframework:spring-webmvc","vulnerableRanges":[">=6.1.0, <6.1.14"],"patched":["6.1.14"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g5vr-rgqm-vf78","url":"https://github.com/advisories/GHSA-g5vr-rgqm-vf78","severity":"HIGH","ecosystem":"Maven","package":"org.springframework:spring-webflux","vulnerableRanges":["<=5.3.40"],"patched":[],"provenance":"source","from":"GHSA"},{"id":"GHSA-g5vr-rgqm-vf78","url":"https://github.com/advisories/GHSA-g5vr-rgqm-vf78","severity":"HIGH","ecosystem":"Maven","package":"org.springframework:spring-webmvc","vulnerableRanges":["<=5.3.40"],"patched":[],"provenance":"source","from":"GHSA"},{"id":"GHSA-g5vr-rgqm-vf78","url":"https://github.com/advisories/GHSA-g5vr-rgqm-vf78","severity":"HIGH","ecosystem":"Maven","package":"org.springframework:spring-webflux","vulnerableRanges":[">=6.0.0, <=6.0.24"],"patched":[],"provenance":"source","from":"GHSA"},{"id":"GHSA-g5vr-rgqm-vf78","url":"https://github.com/advisories/GHSA-g5vr-rgqm-vf78","severity":"HIGH","ecosystem":"Maven","package":"org.springframework:spring-webmvc","vulnerableRanges":[">=6.0.0, <=6.0.24"],"patched":[],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2024-3583","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-3583","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":3,"skipped":2,"earliest":"2024-12-14","earliestUrl":"https://github.com/masa42/CVE-2024-38819-POC","repos":[{"name":"masa42/CVE-2024-38819-POC","url":"https://github.com/masa42/CVE-2024-38819-POC","stars":39,"created":"2024-12-14"},{"name":"GhostS3c/CVE-2024-38819","url":"https://github.com/GhostS3c/CVE-2024-38819","stars":3,"created":"2024-12-16"},{"name":"vishalnoza/CVE-2024-38819-POC2","url":"https://github.com/vishalnoza/CVE-2024-38819-POC2","stars":1,"created":"2025-06-25"}]},"nuclei":[{"id":"CVE-2024-38819","name":"Spring Framework Path Traversal in Functional Web Frameworks","severity":"high","path":"http/cves/2024/CVE-2024-38819.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-38819.yaml"}],"first":{"date":"2024-12-14","source":"PoC-in-GitHub","url":"https://github.com/masa42/CVE-2024-38819-POC"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-12-14","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/masa42/CVE-2024-38819-POC","provenance":"source"},{"date":"2024-12-19","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-38819","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":31.8,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.81,"detail":"percentile 0.9905"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":1.77,"detail":"5 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-spring-framework-cve-2015-5211","parents":[{"from":"CVE-2024-38816","to":"CVE-2024-38819","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.springframework:spring-webmvc","fromFixed":"6.1.13","toFixed":"6.1.14","daysApart":97},{"kind":"version-step","provenance":"source","package":"Maven:org.springframework:spring-webflux","fromFixed":"6.1.13","toFixed":"6.1.14","daysApart":97},{"kind":"same-code","provenance":"machine","files":["spring-webflux/src/main/java/org/springframework/web/reactive/function/server/PathResourceLookupFunction.java","spring-webmvc/src/main/java/org/springframework/web/servlet/function/PathResourceLookupFunction.java"],"commits":["https://github.com/spring-projects/spring-framework/commit/d86bf8b2056429edf5494456cffcb2b243331c49","https://github.com/spring-projects/spring-framework/commit/3bfbe30a7814c9ea1556d40df9bd87ddb3ba372d","https://github.com/spring-projects/spring-framework/commit/fb7890d73975a3d9e0763e0926df2bd0a608e87e"],"basis":"shared function","functions":["apply","isInvalidPath"]},{"kind":"similar","provenance":"machine","score":0.58,"basis":"same package + description similarity"}]},{"from":"CVE-2024-38820","to":"CVE-2024-38819","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["spring-webflux/src/main/java/org/springframework/web/reactive/resource/ResourceWebHandler.java","spring-webmvc/src/main/java/org/springframework/web/servlet/resource/ResourceHttpRequestHandler.java"],"commits":["https://github.com/spring-projects/spring-framework/commit/3bfbe30a7814c9ea1556d40df9bd87ddb3ba372d","https://github.com/spring-projects/spring-framework/commit/fb7890d73975a3d9e0763e0926df2bd0a608e87e","https://github.com/spring-projects/spring-framework/commit/23656aebc6c7d0f9faff1080981eb4d55eff296c"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2023-20860","published":"2023-03-27","fixed":"6.0.7","kev":false},{"cve":"CVE-2023-34053","published":"2023-11-28","fixed":"6.0.14","kev":false},{"cve":"CVE-2024-38816","published":"2024-09-13","fixed":"6.1.13","kev":false},{"cve":"CVE-2024-38819","published":"2024-12-19","fixed":"6.1.14","kev":false},{"cve":"CVE-2025-41242","published":"2025-08-18","fixed":"6.2.10","kev":false},{"cve":"CVE-2026-22735","published":"2026-03-19","fixed":"7.0.6","kev":false},{"cve":"CVE-2026-22737","published":"2026-03-19","fixed":"7.0.6","kev":false}],"package":"Maven:org.springframework:spring-webmvc"}}