Skip to content
Fencer Vulns
high 7.5

CVE-2024-38816 in the critical feed json

CVE-2024-38816: Path traversal vulnerability in functional web frameworks

published 2024-09-13 2 y ago modified 2026-09-10 1 mo ago also GHSA-cx7f-g6mp-7hqm , EUVD-2024-2776

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
21.3%
EPSS 21.3% chance of exploitation in 30 days, percentile 97%
public exploits
0
none known, plus a Nuclei check

Summary

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.

Specifically, an application is vulnerable when both of the following are true:

* the web application uses RouterFunctions to serve static resources * resource handling is explicitly configured with a FileSystemResource location

However, malicious requests are blocked and rejected when any of the following is true:

* the Spring Security HTTP Firewall https://docs.spring.io/spring-security/reference/servlet/exploits/firewall.html  is in use * the application runs on Tomcat or Jetty

Patch / fix

  • maven org.springframework:spring-webmvc 6.1.13
  • maven org.springframework:spring-webflux 6.1.13
  • Spring Spring 5.3.40, 6.0.24, 6.1.13
  • spring_by_vmware_tanzu spring_framework 5.3.40, 6.0.24, 6.1.13

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-38816 updated cvss 7.5

spring-webmvc: Path Traversal Vulnerability in Spring Applications Using RouterFunctions and FileSystemResource

  • Red Hat A-MQ Clients 2 spring-webmvc Red Hat AMQ Broker 7 spring-webmvc Red Hat build of Apache Camel for Spring Boot 3 spring-webmvc Red Hat build of OptaPlanner 8 spring-webmvc Red Hat Fuse 7 spring-webmvc Red Hat Integration Camel K 1 spring-webmvc
    +1 more products
    Red Hat Process Automation 7 spring-webmvc
    affected: workaround, no fix planned “Will not fix”
  • Red Hat HawtIO 4.0.0 for Red Hat build of Apache Camel 4
    fixed: vendor fix RHSA-2024:11023
  • Red Hat build of Apache Camel 4.4.3 for Spring Boot
    fixed: vendor fix RHSA-2024:8064
  • Red Hat Build of Keycloak spring-webmvc Red Hat build of Quarkus spring-webmvc Red Hat Data Grid 8 spring-webmvc Red Hat JBoss Data Grid 7 spring-webmvc Red Hat JBoss Enterprise Application Platform 7 spring-webmvc Red Hat JBoss Enterprise Application Platform 8 spring-webmvc
    +2 more products
    Red Hat JBoss Enterprise Application Platform Expansion Pack spring-webmvc Red Hat Single Sign-On 7 spring-webmvc
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

21.26% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
maven org.springframework:spring-webmvc
>=6.1.0, <6.1.13
>=6.0.0, <=6.0.23
>=5.3.0, <=5.3.39
6.1.13
maven org.springframework:spring-webflux
>=6.1.0, <6.1.13
>=6.0.0, <=6.0.23
>=5.3.0, <=5.3.39
6.1.13

Affected products

  • Spring Spring
  • spring_by_vmware_tanzu spring_framework

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.