Description

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured to serve static resources.

Remediation

References

https://spring.io/security/cve-2023-34062

Related Vulnerabilities

CVE-2015-3190 Vulnerability in maven package org.cloudfoundry.identity:cloudfoundry-identity-login

CVE-2023-50732 Vulnerability in maven package org.xwiki.platform:xwiki-platform-index-tree-macro

CVE-2020-7021 Vulnerability in maven package org.elasticsearch:elasticsearch

CVE-2019-10413 Vulnerability in maven package com.datatheorem.mobileappsecurity.jenkins.plugin:datatheorem-mobile-app-security

CVE-2020-10687 Vulnerability in maven package io.undertow:undertow-core

Severity

High

Classification

CWE-22 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Vendor Advisory