CVE-2024-38819

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Dec 19, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-38828.8A vulnerability was found in Tenda W30E 1.0.1.25(633). It has been classified as critical. Affected is the function fromRouteStatic of the f CVE-2024-388205.3The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale depe CVE-2024-388219.1Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances. CVE-2024-388222.7Multiple methods in the salt master skip minion token validation. Therefore a misbehaving minion can impersonate another minion.CVE-2024-388232.7Salt's request server is vulnerable to replay attacks when not using a TLS encrypted transport.CVE-2024-388247.5Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master cache directory.CVE-2024-388256.4The salt.auth.pki module does not properly authenticate callers. The "password" field contains a public certificate which is validated again CVE-2024-388265.3Authenticated users can upload specifically crafted files to leak server resources. This behavior can potentially be used to run a denial of CVE-2024-388274.8The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorizati CVE-2024-388285.3Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack.CVE-2024-388293.7A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3,CVE-2024-38835.4The 3D FlipBook plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Bookmark URL field in all versions up to, and incl