{"schema":"threatline.record/2","record":{"id":"CVE-2024-38819","aliases":["GHSA-g5vr-rgqm-vf78"],"summary":"Spring Framework Path Traversal vulnerability","details":"Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.","categories":["Frameworks"],"product":"org.springframework:spring-webflux","vendor":"N/A","ecosystem":"maven","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-g5vr-rgqm-vf78","source_modified_at":"2026-09-28T15:50:34Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.springframework:spring-webflux"},"range":">= 6.1.0, < 6.1.14"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-g5vr-rgqm-vf78","source_modified_at":"2026-09-28T15:50:34Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.springframework:spring-webmvc"},"range":">= 6.1.0, < 6.1.14"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-g5vr-rgqm-vf78","source_modified_at":"2026-09-28T15:50:34Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.springframework:spring-webflux"},"range":"<= 5.3.40"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-g5vr-rgqm-vf78","source_modified_at":"2026-09-28T15:50:34Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.springframework:spring-webmvc"},"range":"<= 5.3.40"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-g5vr-rgqm-vf78","source_modified_at":"2026-09-28T15:50:34Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.springframework:spring-webflux"},"range":">= 6.0.0, <= 6.0.24"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-g5vr-rgqm-vf78","source_modified_at":"2026-09-28T15:50:34Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.springframework:spring-webmvc"},"range":">= 6.0.0, <= 6.0.24"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-38819","source_modified_at":"2025-01-10T13:06:45.393Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Spring Framework","vendor":"N/A","versions":[{"status":"affected","version":"Spring Framework 5.3.0 - 5.3.40, 6.0.0 - 6.0.24, 6.1.0 - 6.1.13"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-g5vr-rgqm-vf78","source_modified_at":"2026-09-28T16:00:23.315362856Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.springframework:spring-webflux","purl":"pkg:maven/org.springframework/spring-webflux"},"ranges":[{"events":[{"introduced":"6.1.0"},{"fixed":"6.1.14"}],"type":"ECOSYSTEM"}],"versions":["6.1.0","6.1.1","6.1.10","6.1.11","6.1.12","6.1.13","6.1.2","6.1.3","6.1.4","6.1.5","6.1.6","6.1.7","6.1.8","6.1.9"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-g5vr-rgqm-vf78","source_modified_at":"2026-09-28T16:00:23.315362856Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.springframework:spring-webmvc","purl":"pkg:maven/org.springframework/spring-webmvc"},"ranges":[{"events":[{"introduced":"6.1.0"},{"fixed":"6.1.14"}],"type":"ECOSYSTEM"}],"versions":["6.1.0","6.1.1","6.1.10","6.1.11","6.1.12","6.1.13","6.1.2","6.1.3","6.1.4","6.1.5","6.1.6","6.1.7","6.1.8","6.1.9"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-g5vr-rgqm-vf78","source_modified_at":"2026-09-28T16:00:23.315362856Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.springframework:spring-webflux","purl":"pkg:maven/org.springframework/spring-webflux"},"ranges":[{"events":[{"introduced":"0"},{"last_affected":"5.3.40"}],"type":"ECOSYSTEM"}],"versions":["5.0.0.RELEASE","5.0.1.RELEASE","5.0.10.RELEASE","5.0.11.RELEASE","5.0.12.RELEASE","5.0.13.RELEASE","5.0.14.RELEASE","5.0.15.RELEASE","5.0.16.RELEASE","5.0.17.RELEASE","5.0.18.RELEASE","5.0.19.RELEASE","5.0.2.RELEASE","5.0.20.RELEASE","5.0.3.RELEASE","5.0.4.RELEASE","5.0.5.RELEASE","5.0.6.RELEASE","5.0.7.RELEASE","5.0.8.RELEASE","5.0.9.RELEASE","5.1.0.RELEASE","5.1.1.RELEASE","5.1.10.RELEASE","5.1.11.RELEASE","5.1.12.RELEASE","5.1.13.RELEASE","5.1.14.RELEASE","5.1.15.RELEASE","5.1.16.RELEASE","5.1.17.RELEASE","5.1.18.RELEASE","5.1.19.RELEASE","5.1.2.RELEASE","5.1.20.RELEASE","5.1.3.RELEASE","5.1.4.RELEASE","5.1.5.RELEASE","5.1.6.RELEASE","5.1.7.RELEASE","5.1.8.RELEASE","5.1.9.RELEASE","5.2.0.RELEASE","5.2.1.RELEASE","5.2.10.RELEASE","5.2.11.RELEASE","5.2.12.RELEASE","5.2.13.RELEASE","5.2.14.RELEASE","5.2.15.RELEASE"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-g5vr-rgqm-vf78","source_modified_at":"2026-09-28T16:00:23.315362856Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.springframework:spring-webmvc","purl":"pkg:maven/org.springframework/spring-webmvc"},"ranges":[{"events":[{"introduced":"0"},{"last_affected":"5.3.40"}],"type":"ECOSYSTEM"}],"versions":["1.0","1.0-rc1","1.0.1","1.1","1.1-rc1","1.1-rc2","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.2","1.2-rc1","1.2-rc2","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.2.8","1.2.9","2.0","2.0-m1","2.0-m2","2.0-m3","2.0-m4","2.0-m5","2.0-rc1","2.0-rc2","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.5","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","2.5.6","2.5.6.SEC01","2.5.6.SEC02","2.5.6.SEC03","3.0.0.RELEASE"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-g5vr-rgqm-vf78","source_modified_at":"2026-09-28T16:00:23.315362856Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.springframework:spring-webflux","purl":"pkg:maven/org.springframework/spring-webflux"},"ranges":[{"events":[{"introduced":"6.0.0"},{"last_affected":"6.0.24"}],"type":"ECOSYSTEM"}],"versions":["6.0.0","6.0.1","6.0.10","6.0.11","6.0.12","6.0.13","6.0.14","6.0.15","6.0.16","6.0.17","6.0.18","6.0.19","6.0.2","6.0.20","6.0.21","6.0.22","6.0.23","6.0.3","6.0.4","6.0.5","6.0.6","6.0.7","6.0.8","6.0.9"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-g5vr-rgqm-vf78","source_modified_at":"2026-09-28T16:00:23.315362856Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.springframework:spring-webmvc","purl":"pkg:maven/org.springframework/spring-webmvc"},"ranges":[{"events":[{"introduced":"6.0.0"},{"last_affected":"6.0.24"}],"type":"ECOSYSTEM"}],"versions":["6.0.0","6.0.1","6.0.10","6.0.11","6.0.12","6.0.13","6.0.14","6.0.15","6.0.16","6.0.17","6.0.18","6.0.19","6.0.2","6.0.20","6.0.21","6.0.22","6.0.23","6.0.3","6.0.4","6.0.5","6.0.6","6.0.7","6.0.8","6.0.9"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-g5vr-rgqm-vf78","source_modified_at":"2026-09-28T15:50:34Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.springframework:spring-webflux"},"version":"6.1.14"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-g5vr-rgqm-vf78","source_modified_at":"2026-09-28T15:50:34Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.springframework:spring-webmvc"},"version":"6.1.14"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-g5vr-rgqm-vf78","source_modified_at":"2026-09-28T16:00:23.315362856Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.springframework:spring-webflux","purl":"pkg:maven/org.springframework/spring-webflux"},"version":"6.1.14"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-g5vr-rgqm-vf78","source_modified_at":"2026-09-28T16:00:23.315362856Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.springframework:spring-webmvc","purl":"pkg:maven/org.springframework/spring-webmvc"},"version":"6.1.14"}],"cvss":7.5,"severity":"High","kev":{"listed":false},"epss":{"probability":0.5604,"percentile":0.9905,"score_date":"2026-10-23"},"published_at":"2024-12-19T17:15:12.704Z","modified_at":"2026-09-28T16:00:23.315362856Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-g5vr-rgqm-vf78","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-28T15:50:34Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2024-38819","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2025-01-10T13:06:45.393Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-g5vr-rgqm-vf78","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-28T16:00:23.315362856Z"},{"source":"Nuclei","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-38819.yaml","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":null},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-38819","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","Nuclei","EPSS"],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38819","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://spring.io/security/cve-2024-38819"},{"url":"https://github.com/spring-projects/spring-framework/issues/33689","source":"GitHub Advisory Database"},{"url":"https://github.com/spring-projects/spring-framework/commit/3bfbe30a7814c9ea1556d40df9bd87ddb3ba372d","source":"GitHub Advisory Database"},{"url":"https://github.com/spring-projects/spring-framework/commit/fb7890d73975a3d9e0763e0926df2bd0a608e87e","source":"GitHub Advisory Database"},{"url":"https://security.netapp.com/advisory/ntap-20250110-0010","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-g5vr-rgqm-vf78","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://security.netapp.com/advisory/ntap-20250110-0010/"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2024-12-20T17:53:51.980313Z"},"exploits":[{"kind":"Scanner template","name":"Spring Framework Path Traversal in Functional Web Frameworks","source":"Nuclei","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-38819.yaml"}],"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-28T16:00:23.315362856Z","content_hash":"d7dc9ffd16fb6338aaf9aea6bb394a80327bdadc184b32e136a9ffc0a42572ef"}}