Description
In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured to serve static resources.
Remediation
References
https://spring.io/security/cve-2023-34062
Related Vulnerabilities
CVE-2020-1952 Vulnerability in maven package org.apache.iotdb:iotdb-server
CVE-2022-0853 Vulnerability in maven package jboss:jboss-client
CVE-2015-5174 Vulnerability in maven package org.apache.tomcat:tomcat-util
CVE-2013-2067 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core
CVE-2014-3529 Vulnerability in maven package org.apache.poi:poi-ooxml