Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-98564

CVE-2024-38819: Path traversal vulnerability in org.springframework:spring-webmvc used by Confluence Data Center

XMLWordPrintable

      Issue Summary

      Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.

      Reference: https://spring.io/security/cve-2024-38819

      This is similar to CVE-2024-38816 but with different inputs.

            [CONFSERVER-98564] CVE-2024-38819: Path traversal vulnerability in org.springframework:spring-webmvc used by Confluence Data Center

            Vivek Reddy Polam made changes -
            Fix Version/s New: 9.2.0 [ 110293 ]
            Vivek Reddy Polam made changes -
            Fix Version/s Original: 9.2.0 [ 110293 ]
            Vivek Reddy Polam made changes -
            Security Original: Reporter and Atlassian Staff [ 10751 ]
            Vivek Reddy Polam made changes -
            Fix Version/s New: 9.2.0 [ 110293 ]
            Security Metrics Bot made changes -
            Labels Original: CVE-2024-38816 CVE-2024-38819 ewt-rtb-service-operations-and-tech-entropy internal-kickoff kw-25 security security-imported New: CVE-2024-38816 CVE-2024-38819 ewt-rtb-service-operations-and-tech-entropy internal-kickoff kw-25 resolved-in-vf security security-imported
            Quan Pham made changes -
            Resolution New: Fixed [ 1 ]
            Status Original: Waiting for Release [ 12075 ] New: Closed [ 6 ]
            SET Analytics Bot made changes -
            UIS Original: 1 New: 3
            SET Analytics Bot made changes -
            Support reference count Original: 5 New: 7
            SET Analytics Bot made changes -
            Support reference count Original: 3 New: 5
            SET Analytics Bot made changes -
            UIS New: 1

              534603470b2a Vivek Reddy Polam
              d005923fb04b SNEHA.NELUTA_EXT
              Affected customers:
              0 This affects my team
              Watchers:
              16 Start watching this issue

                Created:
                Updated:
                Resolved: