Directory traversal vulnerability in Pivotal Spring Framework 3.x before 3.2.9 and 4.0…
Priority LOW 32CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Partial · None · None
- Fix status
- Partial Red Hat: 4 fixed, 3 without a fix
Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-22 and the CVSS impact.
Summary
Directory traversal vulnerability in Pivotal Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5 allows remote attackers to read arbitrary files via a crafted URL.
Why it matters now
EPSS 0.06386 93rd percentileScored 2026-11-07
Fix Partial org.springframework:spring-core (Maven): 3.2.9, 4.0.5Red Hat: 4 advisoriesRed Hat: 4 fixed, 3 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.springframework:spring-core (Maven) | 3.0.0 to before 3.2.9 | 3.2.9 | Patch available | GHSA-rhcg-rwhx-qj3j |
| — | org.springframework:spring-core (Maven) | 4.0.0 to before 4.0.5 | 4.0.5 | Patch available | GHSA-rhcg-rwhx-qj3j |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.springframework:spring-core (Maven) Vendor— Affected 3.0.0 to before 3.2.9 Fixed in 3.2.9 Patch available GHSA-rhcg-rwhx-qj3j
- org.springframework:spring-core (Maven) Vendor— Affected 4.0.0 to before 4.0.5 Fixed in 4.0.5 Patch available GHSA-rhcg-rwhx-qj3j
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pivotal_software:spring_framework:*:*:*:*:*:*:*:* | 3.2.0 to before 3.2.9; 4.0.0 to before 4.0.5 | Vulnerable | Spring by Pivotal |
- cpe:2.3:a:pivotal_software:spring_framework:*:*:*:*:*:*:*:* Versions 3.2.0 to before 3.2.9; 4.0.0 to before 4.0.5 Vulnerable ·Spring by Pivotal
Remediation
- Fix · GHSA-rhcg-rwhx-qj3j org.springframework:spring-core (Maven) Fixed in 3.2.9 Advisory →
- Fix · GHSA-rhcg-rwhx-qj3j org.springframework:spring-core (Maven) Fixed in 4.0.5 Advisory →
Red Hat 4 advisories
- RHSA-2015:0720 Released 2015-03-24 · Red Hat rating ImportantRed Hat JBoss Fuse Service Works 6.0.0 security update
- Red Hat JBoss Fuse Service Works 6.0
- RHSA-2015:0675 Released 2015-03-11 · Red Hat rating ImportantRed Hat JBoss Data Virtualization 6.1.0 update
- Red Hat JBoss Data Virtualization 6.1
- RHSA-2015:0234 Released 2015-02-17 · Red Hat rating ImportantRed Hat JBoss BPM Suite 6.0.3 security update
- Red Hat JBoss BPMS 6.0
Show 1 more Red Hat advisories
- RHSA-2015:0235 Released 2015-02-17 · Red Hat rating ImportantRed Hat JBoss BRMS 6.0.3 security update
- Red Hat JBoss BRMS 6.0
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss BRMS 5 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Portal 5 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Portal 6 | Affected | No fix yet |
| Red Hat JBoss BPMS 6.0 | Fixed | RHSA-2015:0234 |
| Red Hat JBoss BRMS 6.0 | Fixed | RHSA-2015:0235 |
| Red Hat JBoss Data Virtualization 6.1 | Fixed | RHSA-2015:0675 |
| Red Hat JBoss Fuse Service Works 6.0 | Fixed | RHSA-2015:0720 |
Not affected: 1 product
- Red Hat JBoss Data Virtualization 6
Timeline
- 2026-10-02 Threatist record created from CVE-2014-3578
- 2026-10-03 Alias added: GHSA-rhcg-rwhx-qj3j
References
Advisory 8
Other 6
- [debian-lts-announce] 20190713 [SECURITY] [DLA 1853-1] libspring-java security update
- https://github.com/spring-projects/spring-framework/issues/16414
- https://github.com/spring-projects/spring-framework/commit/748167bfa33c3c69db2d8dbdc3a0e9da692da3a0
- https://github.com/spring-projects/spring-framework/commit/8ee465103850a3dca018273fe5952e40d5c45a66
- https://github.com/spring-projects/spring-framework/commit/f6fddeb6eb7da625fd711ab371ff16512f431e8d
- https://github.com/spring-projects/spring-framework
More Spring by Pivotal Spring Framework vulnerabilities
- TI-2013-05382 The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and… CVSS 2.0MEDIUM 6.8
- TI-2016-08004 Path traversal in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x… CVSS 3.0HIGH 7.5
- TI-2014-00218 XML external entity injection in Pivotal Spring Framework CVSS 3.0HIGH 8.8
- TI-2016-04327 Access control flaw in Pivotal Spring Security CVSS 3.0HIGH 7.5
- TI-2014-02946 Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before… CVSS 2.0MEDIUM 5.0
- TI-2015-02823 Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process… CVSS 3.0MEDIUM 5.5
Sources
- CVE-2014-3578 · CVE Program
- CVE-2014-3578 · NVD
- FIRST EPSS
- GHSA-rhcg-rwhx-qj3j · GitHub Advisory Database · CC BY 4.0
- CVE-2014-3578 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences