spring-webmvc-4.2.0.RELEASE.jar: 5 vulnerabilities (highest severity is: 9.3) [vp-rem] (reachable)

[mend-developer-platform-dev]

📂 Vulnerable Library - spring-webmvc-4.2.0.RELEASE.jar

Spring Web MVC

Library home page: http://projects.spring.io/spring-framework

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-webmvc/4.2.0.RELEASE/spring-webmvc-4.2.0.RELEASE.jar

Findings

Finding	Severity	🎯 CVSS	Exploit Maturity	EPSS	Library	Type	Fixed in	Remediation Available	Reachability
CVE-2015-5211	🟣 Critical	9.3	Not Defined	1.9%	spring-webmvc-4.2.0.RELEASE.jar	Direct	org.springframework:spring-web:4.2.2.RELEASE,4.1.8.RELEASE,3.2.15.RELEASE,org.springframework:spring-webmvc:4.2.2.RELEASE,4.1.8.RELEASE,3.2.15.RELEASE,org.springframework:spring-websocket:4.2.2.RELEASE,4.1.8.RELEASE,3.2.15.RELEASE	✅	Reachable
CVE-2016-5007	🔴 High	8.7	Not Defined	< 1%	spring-webmvc-4.2.0.RELEASE.jar	Direct	org.springframework:spring-webmvc:4.3.0.RELEASE,org.springframework.security:spring-security-web:4.1.1.RELEASE,org.springframework.security:spring-security-config:4.1.1.RELEASE	✅	Reachable
CVE-2016-9878	🔴 High	8.7	Not Defined	4.9%	spring-webmvc-4.2.0.RELEASE.jar	Direct	3.2.18,4.2.9,4.3.5.	✅	Unreachable
CVE-2018-1271	🔴 High	8.2	Not Defined	91.2%	spring-webmvc-4.2.0.RELEASE.jar	Direct	org.springframework:spring-webflux:5.0.5.RELEASE,org.springframework:spring-webmvc:4.3.15.RELEASE,5.0.5.RELEASE	✅	Reachable
CVE-2021-22096	🟠 Medium	5.3	Not Defined	< 1%	spring-webmvc-4.2.0.RELEASE.jar	Direct	N/A	❌	Reachable

Details

🟣CVE-2015-5211

Vulnerable Library - spring-webmvc-4.2.0.RELEASE.jar

Spring Web MVC

Library home page: http://projects.spring.io/spring-framework

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-webmvc/4.2.0.RELEASE/spring-webmvc-4.2.0.RELEASE.jar

Dependency Hierarchy:

• ❌ spring-webmvc-4.2.0.RELEASE.jar (Vulnerable Library)

---

Reachability Analysis

This vulnerability is potentially reachable:

- com.visualpathit.account.validator.UserValidator (Application)
    - org.springframework.web.servlet.config.annotation.WebMvcConfigurationSupport$NoOpValidator (Extension)
        - org.springframework.web.servlet.config.annotation.WebMvcConfigurationSupport (Extension)
            - org.springframework.web.servlet.config.annotation.ViewResolverRegistry (Extension)
                - org.springframework.web.servlet.view.tiles3.TilesConfigurer (Extension)
                    -> ❌ org.springframework.web.servlet.view.tiles3.TilesConfigurer$SpringCompleteAutoloadTilesContainerFactory (Vulnerable Component)

---

Vulnerability Details

Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being downloaded rather than rendered and also includes some input reflected in the response.

Publish Date: May 25, 2017 05:00 PM

URL: CVE-2015-5211

Threat Assessment

Exploit Maturity:Not Defined

EPSS:1.9%

Score: 9.3

---

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5211

Release Date: May 25, 2017 05:00 PM

Fix Resolution : org.springframework:spring-web:4.2.2.RELEASE,4.1.8.RELEASE,3.2.15.RELEASE,org.springframework:spring-webmvc:4.2.2.RELEASE,4.1.8.RELEASE,3.2.15.RELEASE,org.springframework:spring-websocket:4.2.2.RELEASE,4.1.8.RELEASE,3.2.15.RELEASE

🔴CVE-2016-5007

Vulnerable Library - spring-webmvc-4.2.0.RELEASE.jar

Spring Web MVC

Library home page: http://projects.spring.io/spring-framework

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-webmvc/4.2.0.RELEASE/spring-webmvc-4.2.0.RELEASE.jar

Dependency Hierarchy:

• ❌ spring-webmvc-4.2.0.RELEASE.jar (Vulnerable Library)

---

Reachability Analysis

This vulnerability is potentially reachable:

- com.visualpathit.account.validator.UserValidator (Application)
    - org.springframework.web.servlet.config.annotation.WebMvcConfigurationSupport$NoOpValidator (Extension)
        - org.springframework.web.servlet.config.annotation.WebMvcConfigurationSupport (Extension)
            - org.springframework.web.servlet.handler.BeanNameUrlHandlerMapping (Extension)
                - org.springframework.web.servlet.handler.AbstractDetectingUrlHandlerMapping (Extension)
                    -> ❌ org.springframework.web.servlet.handler.AbstractUrlHandlerMapping (Vulnerable Component)

---

Vulnerability Details

Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences.

Publish Date: May 25, 2017 05:00 PM

URL: CVE-2016-5007

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 8.7

---

Suggested Fix

Type: Upgrade version

Origin: https://pivotal.io/security/cve-2016-5007

Release Date: May 25, 2017 05:00 PM

Fix Resolution : org.springframework:spring-webmvc:4.3.0.RELEASE,org.springframework.security:spring-security-web:4.1.1.RELEASE,org.springframework.security:spring-security-config:4.1.1.RELEASE

🔴CVE-2016-9878

Vulnerable Library - spring-webmvc-4.2.0.RELEASE.jar

Spring Web MVC

Library home page: http://projects.spring.io/spring-framework

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-webmvc/4.2.0.RELEASE/spring-webmvc-4.2.0.RELEASE.jar

Dependency Hierarchy:

• ❌ spring-webmvc-4.2.0.RELEASE.jar (Vulnerable Library)

---

Reachability Analysis

The vulnerable code is unreachable

---

Vulnerability Details

An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks.

Publish Date: Dec 29, 2016 09:02 AM

URL: CVE-2016-9878

Threat Assessment

Exploit Maturity:Not Defined

EPSS:4.9%

Score: 8.7

---

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9878

Release Date: Dec 29, 2016 09:02 AM

Fix Resolution : 3.2.18,4.2.9,4.3.5.

🔴CVE-2018-1271

Vulnerable Library - spring-webmvc-4.2.0.RELEASE.jar

Spring Web MVC

Library home page: http://projects.spring.io/spring-framework

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-webmvc/4.2.0.RELEASE/spring-webmvc-4.2.0.RELEASE.jar

Dependency Hierarchy:

• ❌ spring-webmvc-4.2.0.RELEASE.jar (Vulnerable Library)

---

Reachability Analysis

This vulnerability is potentially reachable:

- com.visualpathit.account.validator.UserValidator (Application)
    - org.springframework.web.servlet.config.annotation.WebMvcConfigurationSupport$NoOpValidator (Extension)
        - org.springframework.web.servlet.config.annotation.WebMvcConfigurationSupport (Extension)
            - org.springframework.web.servlet.resource.ResourceUrlProvider (Extension)
                - org.springframework.web.servlet.resource.ResourceHttpRequestHandler (Extension)
                    -> ❌ org.springframework.web.servlet.resource.PathResourceResolver (Vulnerable Component)

---

Vulnerability Details

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.

Publish Date: Apr 06, 2018 01:00 PM

URL: CVE-2018-1271

Threat Assessment

Exploit Maturity:Not Defined

EPSS:91.2%

Score: 8.2

---

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1271

Release Date: Apr 06, 2018 01:00 PM

Fix Resolution : org.springframework:spring-webflux:5.0.5.RELEASE,org.springframework:spring-webmvc:4.3.15.RELEASE,5.0.5.RELEASE

🟠CVE-2021-22096

Vulnerable Library - spring-webmvc-4.2.0.RELEASE.jar

Spring Web MVC

Library home page: http://projects.spring.io/spring-framework

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-webmvc/4.2.0.RELEASE/spring-webmvc-4.2.0.RELEASE.jar

Dependency Hierarchy:

• ❌ spring-webmvc-4.2.0.RELEASE.jar (Vulnerable Library)

---

Reachability Analysis

This vulnerability is potentially reachable:

- com.visualpathit.account.validator.UserValidator (Application)
    - org.springframework.web.servlet.config.annotation.WebMvcConfigurationSupport$NoOpValidator (Extension)
        - org.springframework.web.servlet.config.annotation.WebMvcConfigurationSupport (Extension)
            - org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry (Extension)
                -> ❌ org.springframework.web.servlet.resource.ResourceHttpRequestHandler (Vulnerable Component)

---

Vulnerability Details

In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.

Publish Date: Oct 28, 2021 03:22 PM

URL: CVE-2021-22096

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 5.3

---

Suggested Fix

Type: Upgrade version

Origin:

Release Date:

Fix Resolution :