Description
In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured to serve static resources.
Remediation
References
https://spring.io/security/cve-2023-34062
Related Vulnerabilities
CVE-2014-7810 Vulnerability in maven package org.mortbay.jasper:apache-jsp
CVE-2023-37478 Vulnerability in npm package @pnpm/macos-x64
CVE-2016-10366 Vulnerability in npm package kibana
CVE-2023-22621 Vulnerability in npm package @strapi/plugin-email
CVE-2022-22965 Vulnerability in maven package org.springframework.boot:spring-boot-starter-web