Description

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured to serve static resources.

Remediation

References

https://spring.io/security/cve-2023-34062

Related Vulnerabilities

CVE-2021-43980 Vulnerability in maven package org.apache.tomcat:tomcat

CVE-2018-14042 Vulnerability in maven package org.webjars.bowergithub.twbs:bootstrap

CVE-2019-12416 Vulnerability in maven package org.apache.deltaspike.modules:deltaspike-jsf-module-impl

CVE-2023-49299 Vulnerability in maven package org.apache.dolphinscheduler:dolphinscheduler-master

CVE-2007-0184 Vulnerability in maven package dwr:dwr

Severity

High

Classification

CWE-22 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Vendor Advisory