CVE-2016-9878
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2016-9878
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-9878.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2016-9878
- Aliases
- Downstream
- Published
- 2016-12-29T09:59:00.820Z
- Modified
- 2025-11-14T04:56:57.540792Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- [none]
- Details
-
An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks.
- References
-
- http://www.securitytracker.com/id/1040698
- https://lists.debian.org/debian-lts-announce/2019/07/msg00012.html
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.securityfocus.com/bid/95072
- https://access.redhat.com/errata/RHSA-2017:3115
- https://pivotal.io/security/cve-2016-9878
- https://security.netapp.com/advisory/ntap-20180419-0002/
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
Affected packages
Git / github.com/spring-projects/spring-framework
Affected ranges
- Type
- GIT
- Repo
- https://github.com/spring-projects/spring-framework
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affectedLast affected