VMware Tanzu Spring Framework: Schwachstelle ermöglicht Offenlegung von Informationen

Summary

Product

Vulnerabilities 1

• High 7.5
  CVE-2024-38816 Public exploit Scanner template EPSS 21%

  CVE-2024-38816: Path traversal vulnerability in functional web frameworks

  Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the p…

  Spring Spring thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Sep 13, 2024

Revision history

1. 2026-03-23 #6

   Neue Updates von Dell aufgenommen

2. 2025-10-13 #5

   Neue Updates aufgenommen

3. 2025-04-06 #4

   Neue Updates von IBM aufgenommen

4. 2025-01-07 #3

   Neue Updates von IBM aufgenommen

5. 2024-12-29 #2

   Neue Updates von NetApp aufgenommen

6. 2024-09-12 #1

   Initiale Fassung

References

• Spring Framework Release 5.3.40 and 6.0.24 vom 2024-09-12
  https://spring.io/blog/2024/09/12/spring-framework-5-3-40-and-6-0-24-available-now
• Spring Framework CVE-2024-38816 vom 2024-09-12
  https://spring.io/blog/2024/09/12/spring-framework-releases-fixes-for-cve-2024-38816
• NetApp Security Advisory NTAP-20241227-0001 vom 2024-12-27
  https://security.netapp.com/advisory/ntap-20241227-0001/
• IBM Security Bulletin 7180385 vom 2025-01-07
  https://www.ibm.com/support/pages/node/7180385
• IBM Security Bulletin 7229205 vom 2025-04-05
  https://www.ibm.com/support/pages/node/7229205
• Solarwinds SEM 2025.4 release notes vom 2025-10-14
  https://documentation.solarwinds.com/en/success_center/sem/content/release_notes/sem_2025-4_release_notes.htm
• Dell Security Advisory DSA-2026-152 vom 2026-03-23
  https://www.dell.com/support/kbdoc/de-de/000443243/dsa-2026-152-dell-secure-connect-gateway-security-update-for-multiple-third-party-component-vulnerabilities