CVE-2014-3578 Medium Severity Vulnerability detected by WhiteSource

[mend-bolt-for-github]

CVE-2014-3578 - Medium Severity Vulnerability

Vulnerable Library - spring-core-4.0.0.RELEASE.jar

path: 2/repository/org/springframework/spring-core/4.0.0.RELEASE/spring-core-4.0.0.RELEASE.jar

Library home page: https://github.com/SpringSource/spring-framework

Dependency Hierarchy:

• ❌ spring-core-4.0.0.RELEASE.jar (Vulnerable Library)

Found in commit: f396e60bf74726f66a202d308a1f2865177e4bee

Vulnerability Details

Directory traversal vulnerability in Pivotal Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5 allows remote attackers to read arbitrary files via a crafted URL.

Publish Date: 2015-02-19

URL: CVE-2014-3578

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: http://pivotal.io/security/cve-2014-3578

Release Date: 2017-12-31

Fix Resolution: Users of affected versions should apply the following mitigation: Users of 3.x should upgrade to 3.2.9 or later Users of 4.x should upgrade to 4.0.5 or later

---

Step up your Open Source Security Game with WhiteSource here