Description
In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured to serve static resources.
Remediation
References
https://spring.io/security/cve-2023-34062
Related Vulnerabilities
CVE-2023-37950 Vulnerability in maven package com.mabl.integration.jenkins:mabl-integration
CVE-2020-9480 Vulnerability in maven package org.apache.spark:spark-network-shuffle_2.10
CVE-2019-17632 Vulnerability in maven package org.eclipse.jetty:jetty-server
CVE-2022-31160 Vulnerability in npm package jquery-ui
CVE-2022-23106 Vulnerability in maven package io.jenkins:configuration-as-code