crítica
CVE-2015-5211
Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4 ...
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
GHSA8.6CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según GHSA (alta), Ubuntu (media).
Descripción
Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being downloaded rather than rendered and also includes some input reflected in the response.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 11 | libspring-java | 4.1.9-1 |
| debian 12 | libspring-java | 4.1.9-1 |
| debian 13 | libspring-java | 4.1.9-1 |
| debian 14 | libspring-java | 4.1.9-1 |
| debian 7 | libspring-java | sin corrección indicada |
| debian 8 | libspring-java | 3.0.6.RELEASE-17+deb8u1 |
| echo | libspring-java | 4.1.9-1 |
| maven::GitHub Security Advisory Maven | org.springframework:spring-core | 4.2.2, 4.1.8, 3.2.15 |
| seal maven::Seal Security Database | org.springframework:spring-core, org.springframework:spring-web, seal.sp1.org.springframework:spring-core y 1 más | 3.2.2.RELEASE+sp999 y 2 más |
| ubuntu 14.04-ESM | libspring-java | 3.0.6.RELEASE-13ubuntu0.1~esm2 |
| ubuntu 16.04-ESM | libspring-java | 3.2.13-5ubuntu0.1~esm1 |
Mostrar las 14 entradas de 11 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 11 | libspring-java | 4.1.9-1 |
| debian 12 | libspring-java | 4.1.9-1 |
| debian 13 | libspring-java | 4.1.9-1 |
| debian 14 | libspring-java | 4.1.9-1 |
| debian 7 | libspring-java | sin corrección indicada |
| debian 8 | libspring-java | 3.0.6.RELEASE-17+deb8u1 |
| echo | libspring-java | 4.1.9-1 |
| maven::GitHub Security Advisory Maven | org.springframework:spring-core | 4.2.2, 4.1.8, 3.2.15 |
| seal maven::Seal Security Database | org.springframework:spring-core | 3.2.2.RELEASE+sp999 |
| seal maven::Seal Security Database | org.springframework:spring-web | 4.2.0.RELEASE+sp2 |
| seal maven::Seal Security Database | seal.sp1.org.springframework:spring-core | 3.2.2.RELEASE+sp999 |
| seal maven::Seal Security Database | seal.sp1.org.springframework:spring-web | 4.2.0.RELEASE+sp999 |
| ubuntu 14.04-ESM | libspring-java | 3.0.6.RELEASE-13ubuntu0.1~esm2 |
| ubuntu 16.04-ESM | libspring-java | 3.2.13-5ubuntu0.1~esm1 |
Referencias
- https://github.com/advisories/GHSA-pgf9-h69p-pcgf
- https://github.com/spring-projects/spring-framework
- https://github.com/spring-projects/spring-framework/commit/03f547
- https://github.com/spring-projects/spring-framework/commit/03f547eb9868f48f44d59b56067d4ac4740672c3
- https://github.com/spring-projects/spring-framework/commit/2bd1da
- https://github.com/spring-projects/spring-framework/commit/2bd1daa75ee0b8ec33608ca6ab065ef3e1815543
- https://github.com/spring-projects/spring-framework/commit/a95c3d
- https://github.com/spring-projects/spring-framework/commit/a95c3d820dbc4c3ae752f1b3ee22ee860b162402
Las 16 referencias
- https://jira.spring.io/browse/SPR-13548
- https://lists.debian.org/debian-lts-announce/2019/07/msg00012.html
- https://nvd.nist.gov/vuln/detail/CVE-2015-5211
- https://pivotal.io/security/cve-2015-5211
- https://ubuntu.com/security/notices/USN-4774-1
- https://www.cve.org/CVERecord?id=CVE-2015-5211
- https://www.trustwave.com/Resources/SpiderLabs-Blog/Reflected-File-Download---A-New-Web-Attack-Vector
- https://www.trustwave.com/Resources/SpiderLabs-Blog/Reflected-File-Download---A-New-Web-Attack-Vector/