CVE-2014-3578

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

Directory traversal vulnerability in Pivotal Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5 allows remote attackers to read arbitrary files via a crafted URL.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://jvn.jp/en/jp/JVN49154900/index.htmlThird Party Advisory, VDB Entry
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000054Third Party Advisory, VDB Entry
http://pivotal.io/security/cve-2014-3578Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-0720.htmlThird Party Advisory
http://www.securityfocus.com/bid/68042Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1131882Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/07/msg00012.html
https://rhn.redhat.com/errata/RHSA-2015-0234.htmlThird Party Advisory
https://rhn.redhat.com/errata/RHSA-2015-0235.htmlThird Party Advisory
http://jvn.jp/en/jp/JVN49154900/index.htmlThird Party Advisory, VDB Entry
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000054Third Party Advisory, VDB Entry
http://pivotal.io/security/cve-2014-3578Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-0720.htmlThird Party Advisory
http://www.securityfocus.com/bid/68042Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1131882Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/07/msg00012.html
https://rhn.redhat.com/errata/RHSA-2015-0234.htmlThird Party Advisory
https://rhn.redhat.com/errata/RHSA-2015-0235.htmlThird Party Advisory

Timeline

Published: Feb 19, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-35799.8XML external entity (XXE) vulnerability in Apache ActiveMQ Apollo 1.x before 1.7.1 allows remote consumers to have unspecified impact via ve CVE-2014-35805.0The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a CVE-2014-35815.0The cache_merge_headers_out function in modules/cache/cache_util.c in the mod_cache module in the Apache HTTP Server before 2.4.11 allows re CVE-2014-35829.8In Ambari 1.2.0 through 2.2.2, it may be possible to execute arbitrary system commands on the Ambari Server host while generating SSL certif CVE-2014-35835.0The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP Server 2.4.10 allows remote FastCGI servers CVE-2014-35845.0The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial of CVE-2014-35859.8redhat-upgrade-tool: Does not check GPG signatures when upgrading versions CVE-2014-35862.1The default configuration for the Command Line Interface in Red Hat Enterprise Application Platform before 6.4.0 and WildFly (formerly JBoss CVE-2014-35874.3Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.3 CVE-2014-35895.0PIL/IcnsImagePlugin.py in Python Imaging Library (PIL) and Pillow before 2.3.2 and 2.5.x before 2.5.2 allows remote attackers to cause a den CVE-2014-35906.5Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. Therefore, an attacker CVE-2014-35914.2Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proxim