Description
In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured to serve static resources.
Remediation
References
https://spring.io/security/cve-2023-34062
Related Vulnerabilities
CVE-2021-22112 Vulnerability in maven package org.springframework.security:spring-security-core
CVE-2015-8031 Vulnerability in maven package org.jvnet.hudson.main:hudson-core
CVE-2023-28673 Vulnerability in maven package org.jenkinsci.plugins:octoperf
CVE-2020-10776 Vulnerability in maven package org.keycloak:keycloak-parent