deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-qpp6-f3qj-rggq
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 7.4.0-ga1, <= 7.4.3.132-ga132
Patched in: unpatched

Summary: Liferay Portal's Unlimited File Upload Could Result in DoS

Details:
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allow users to upload an unlimited amount of files through the object entries attachment fields, the files are stored in the document_library allowing an attacker to cause a potential DDoS.
GitHub Security Advisory: GHSA-w2wj-hw98-233h
Package: org.keycloak:keycloak-model-storage-services (MAVEN)
Severity: MODERATE (CVSS 4.9)
CWE: CWE-526: Cleartext Storage of Sensitive Information in an Environment Variable
Vulnerable versions: <= 26.3.3
Patched in: unpatched

Summary: Duplicate Advisory: Keycloak Potential Variable Reference in Model Storage Services

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-8hxp-qmph-w5gq. This link is maintained to preserve external references.

### Original Description

A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documents, potentially referencing environment variables. This substitution process
allows for injection attacks when crafted realm documents are processed. An attacker can leverage this to inject malicious content during the realm import procedure. This can lead to unintended consequences within the Keycloak environment.
GitHub Security Advisory: GHSA-p72g-pv48-7w9x
Package: org.apache.tika:tika-parser-pdf-module (MAVEN)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-611: Improper Restriction of XML External Entity Reference
Vulnerable versions: >= 1.13, < 3.2.2
Patched in: 3.2.2

Summary: Apache Tika XXE Vulnerability via Crafted XFA File Inside a PDF

Details:
Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard.

Users are recommended to upgrade to version 3.2.2, which fixes this issue.
GitHub Security Advisory: GHSA-62pf-hcwj-rcfc
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.4.0-ga1, <= 7.4.3.132-ga132
Patched in: unpatched

Summary: Liferay Portal Vulnerable to Cross-Site Scripting via DDMPortlet_definition Parameter

Details:
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code via _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_definition parameter.
GitHub Security Advisory: GHSA-mpww-r37c-vxjw
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.4.0-ga1, <= 7.4.3.132-ga132
Patched in: unpatched

Summary: Liferay Portal Vulnerable to Cross-Site Scripting in Dynamic Data Mapping

Details:
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code via _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_portletNamespace and _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_namespace parameter.
GitHub Security Advisory: GHSA-p9gc-59hf-x48p
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 7.0.0-a1, < 7.4.3.120-ga120
Patched in: 7.4.3.120-ga120

Summary: Liferay Portal Vulnerable to Cross-Site Request Forgery

Details:
Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.6, 2023.Q4.0 through 2023.Q4.9, 2023.Q3.1 through 2023.Q3.9, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allows attackers to execute Cross-Site Request Forgery
GitHub Security Advisory: GHSA-5fx5-cff6-f3fp
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-552: Files or Directories Accessible to External Parties
Vulnerable versions: >= 7.4.0-ga1, <= 7.4.3.132-ga132
Patched in: unpatched

Summary: Liferay Portal Unauthenticated File Access via URL

Details:
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows unauthenticated users (guests) to access via URL files uploaded in the form and stored in document_library.
GitHub Security Advisory: GHSA-56qj-wp5r-mvhj
Package: com.liferay:com.liferay.dynamic.data.mapping.form.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-434: Unrestricted Upload of File with Dangerous Type
Vulnerable versions: < 4.0.180
Patched in: 4.0.180

Summary: Liferay Portal Unvalidated File Upload

Details:
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows remote unauthenticated users (guests) to upload files via the form attachment field without proper validation, enabling extension obfuscation and bypassing MIME type checks.
GitHub Security Advisory: GHSA-j6p8-g3rj-ghpm
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.4.0-ga1, <= 7.4.3.132-ga132
Patched in: unpatched

Summary: Liferay Portal Vulnerable to Cross-Site Scripting via assetTagNames Parameter

Details:
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScrip in the _com_liferay_users_admin_web_portlet_UsersAdminPortlet_assetTagNames parameter
GitHub Security Advisory: GHSA-3fp2-6mwq-4q3j
Package: com.liferay:com.liferay.layout.type.controller.display.page (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 3.0.59
Patched in: 3.0.59

Summary: Liferay Portal Vulnerable to Cross-Site Scripting through URLs

Details:
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript in web content for friendly urls.
GitHub Security Advisory: GHSA-m49p-6cjp-x2h3
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.4.0-ga1, <= 7.4.3.132-ga132
Patched in: unpatched

Summary: Liferay Portal Vulnerable to Cross-Site Scripting via DDM Structure Field Labels

Details:
A stored DOM-based Cross-Site Scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.5, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 exists in the Asset Publisher configuration UI within the Source.js module. This vulnerability allows attackers to inject arbitrary JavaScript via DDM structure field labels which are then inserted into the DOM using innerHTML without proper encoding.
GitHub Security Advisory: GHSA-hf86-8x8v-h7vc
Package: org.apache.eventmesh:eventmesh-runtime (MAVEN)
Severity: MODERATE (CVSS 6.3)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 1.6.0-release, <= 1.11.0-release
Patched in: unpatched

Summary: Apache EventMesh Vulnerable to Server-Side Request Forgery in WebhookUtil.java

Details:
Server-Side Request Forgery (SSRF) in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources.
Users are recommended to upgrade to version 1.12.0 or use the master branch, which fixes this issue.
GitHub Security Advisory: GHSA-g4vp-4gqr-7v8c
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-203: Observable Discrepancy
Vulnerable versions: >= 7.4.0-ga1, <= 7.4.3.132-ga132
Patched in: unpatched

Summary: Liferay Portal Enumeration Discrepancy in Calendars

Details:
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows any authenticated remote user to view other calendars by allowing them to enumerate the names of other users, given an attacker the possibility to send phishing to these users.
GitHub Security Advisory: GHSA-vjwr-cqwf-6q96
Package: com.liferay:com.liferay.journal.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 5.0.196
Patched in: 5.0.196

Summary: Liferay Portal Vulnerable to Cross-Site Scripting via backURL Paramter

Details:
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8 and 2025.Q1.0 through 2025.Q1.15 allows a remote authenticated user to inject JavaScript code via _com_liferay_journal_web_portlet_JournalPortlet_backURL parameter.
GitHub Security Advisory: GHSA-7q33-gwcm-r6cj
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 7.4.0-ga1, <= 7.4.3.132-ga132
Patched in: unpatched

Summary: Liferay Portal CSRF Vulnerability via Endpoint Parameter

Details:
A CSRF vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.7, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows remote attackers to performs cross-origin request on behalf of the authenticated user via the endpoint parameter.
GitHub Security Advisory: GHSA-cwgh-r52j-xh6c
Package: com.liferay:com.liferay.expando.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 5.0.59
Patched in: unpatched

Summary: Liferay Portal Reflected Cross-Site Scripting Vulnerability in displayType Parameter

Details:
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.19 allows a remote authenticated user to inject JavaScript code via _com_liferay_expando_web_portlet_ExpandoPortlet_displayType parameter.

Liferay Portal is fixed on the master branch from commit acc4771.
GitHub Security Advisory: GHSA-7mxq-h2r7-h449
Package: com.liferay:com.liferay.calendar.service (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-203: Observable Discrepancy
Vulnerable versions: < 6.0.83
Patched in: 6.0.83

Summary: Liferay Portal Email Modification Vulnerability via Calendar Portlet

Details:
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allow any authenticated user to modify the content of emails sent through the calendar portlet, allowing an attacker to send phishing emails to any other user in the same organization.

Liferay Portal is fixed on the master branch from commit ff18e7d.
GitHub Security Advisory: GHSA-22jp-w3cg-gvmm
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.4.3.120-ga120, <= 7.4.3.132-ga23
Patched in: unpatched

Summary: Liferay Portal has Stored Cross-Site Scripting Vulnerability via Message Boards Feature

Details:
A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.3.120 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13 and 2024.Q1.9 through 2024.Q1.19 allows an remote authenticated attacker to inject JavaScript through the message boards feature available via the web interface.

Liferay Portal is fixed on the master branch from commit c1b7c6b.
GitHub Security Advisory: GHSA-v6cf-mv9h-c8mc
Package: org.bouncycastle:bc-fips (MAVEN)
Severity: LOW (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: = 2.1.0
Patched in: 2.1.1

Summary: Bouncy Castle for Java Uncontrolled Resource Consumption Vulnerability

Details:
Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java - BC-FJA 2.1.0 bc-fips (API modules) allows Excessive Allocation. This vulnerability is associated with program files org.Bouncycastle.Crypto.Fips.NativeLoader.

This issue affects Bouncy Castle for Java - BC-FJA 2.1.0: from BC-FJA 2.1.0 through 2.1.0.
GitHub Security Advisory: GHSA-3p2m-574v-v257
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.4.0-ga1, <= 7.4.3.132-ga132
Patched in: unpatched

Summary: Liferay Portal Vulnerable to Cross-Site Scripting

Details:
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows an remote authenticated user to inject JavaScript in message board threads and categories.
GitHub Security Advisory: GHSA-g4wg-mpfg-x2q6
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: LOW (CVSS 0.0)
CWE: CWE-288: Authentication Bypass Using an Alternate Path or Channel
Vulnerable versions: >= 7.3.0-ga1, <= 7.4.3.132-ga132
Patched in: unpatched

Summary: Liferay Portal Login Bypass Vulnerability

Details:
Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 and 7.3 GA through update 36 allows unauthenticated users with valid credentials to bypass the login process by changing the POST method to GET, once the site has MFA enabled.
GitHub Security Advisory: GHSA-v6xr-v2qg-h22h
Package: com.liferay:com.liferay.roles.selector.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: < 5.0.32
Patched in: 5.0.32

Summary: Liferay Portal Vulnerable to Insecure Direct Object Reference

Details:
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.17 and 7.4 GA through update 92 is vulnerable to Insecure Direct Object Reference (IDOR) in the groupId parameter of the _com_liferay_roles_selector_web_portlet_RolesSelectorPortlet_groupId. When an organization administrator modifies this parameter id value, they can gain unauthorized access to user lists from other organizations.
GitHub Security Advisory: GHSA-vhcr-hgc8-29qr
Package: com.liferay:com.liferay.layout.taglib (MAVEN)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 17.0.0
Patched in: 17.0.0

Summary: Liferay Portal Vulnerable to Cross-Site Scripting 

Details:
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.7 allows a remote authenticated attacker to inject JavaScript code via the content page's name field. This malicious payload is then reflected and executed within the user's browser when viewing the "document View Usages" page.

Liferay Portal is fixed on the master branch from commit 2135a88.
GitHub Security Advisory: GHSA-r936-gwx5-v52f
Package: org.springframework:spring-webmvc (MAVEN)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 5.3.0, <= 5.3.43
Patched in: unpatched

Summary: Spring Framework MVC Applications Path Traversal Vulnerability

Details:
Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container.

An application can be vulnerable when all the following are true:

  *  the application is deployed as a WAR or with an embedded Servlet container
  *  the Servlet container  does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization 
  *  the application  serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title  with Spring resource handling


We have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.
GitHub Security Advisory: GHSA-r936-gwx5-v52f
Package: org.springframework:spring-webmvc (MAVEN)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 6.0.0, <= 6.0.29
Patched in: unpatched

Summary: Spring Framework MVC Applications Path Traversal Vulnerability

Details:
Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container.

An application can be vulnerable when all the following are true:

  *  the application is deployed as a WAR or with an embedded Servlet container
  *  the Servlet container  does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization 
  *  the application  serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title  with Spring resource handling


We have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.
GitHub Security Advisory: GHSA-r936-gwx5-v52f
Package: org.springframework:spring-webmvc (MAVEN)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 6.1.0, <= 6.1.21
Patched in: unpatched

Summary: Spring Framework MVC Applications Path Traversal Vulnerability

Details:
Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container.

An application can be vulnerable when all the following are true:

  *  the application is deployed as a WAR or with an embedded Servlet container
  *  the Servlet container  does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization 
  *  the application  serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title  with Spring resource handling


We have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.
GitHub Security Advisory: GHSA-r936-gwx5-v52f
Package: org.springframework:spring-webmvc (MAVEN)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 6.2.0, < 6.2.10
Patched in: 6.2.10

Summary: Spring Framework MVC Applications Path Traversal Vulnerability

Details:
Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container.

An application can be vulnerable when all the following are true:

  *  the application is deployed as a WAR or with an embedded Servlet container
  *  the Servlet container  does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization 
  *  the application  serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title  with Spring resource handling


We have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.