{
  "GSD": {
    "alias": "CVE-2014-3625",
    "description": "Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling.",
    "id": "GSD-2014-3625",
    "references": [
      "https://access.redhat.com/errata/RHSA-2015:0720",
      "https://access.redhat.com/errata/RHSA-2015:0236",
      "https://access.redhat.com/errata/RHSA-2015:0235",
      "https://access.redhat.com/errata/RHSA-2015:0234",
      "https://ubuntu.com/security/CVE-2014-3625"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2014-3625"
      ],
      "details": "Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling.",
      "id": "GSD-2014-3625",
      "modified": "2023-12-13T01:22:53.607999Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secalert@redhat.com",
        "ID": "CVE-2014-3625",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "RHSA-2015:0720",
            "refsource": "REDHAT",
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0720.html"
          },
          {
            "name": "http://www.pivotal.io/security/cve-2014-3625",
            "refsource": "CONFIRM",
            "url": "http://www.pivotal.io/security/cve-2014-3625"
          },
          {
            "name": "https://jira.spring.io/browse/SPR-12354",
            "refsource": "CONFIRM",
            "url": "https://jira.spring.io/browse/SPR-12354"
          },
          {
            "name": "RHSA-2015:0236",
            "refsource": "REDHAT",
            "url": "http://rhn.redhat.com/errata/RHSA-2015-0236.html"
          },
          {
            "name": "[debian-lts-announce] 20190713 [SECURITY] [DLA 1853-1] libspring-java security update",
            "refsource": "MLIST",
            "url": "https://lists.debian.org/debian-lts-announce/2019/07/msg00012.html"
          }
        ]
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "[3.2-alpha0,3.2.11.RELEASE],[4.0-alpha0,4.0.7.RELEASE],[4.1-alpha0,4.1.1.RELEASE]",
          "affected_versions": "All versions starting from 3.2-alpha0 up to 3.2.11.release, all versions starting from 4.0-alpha0 up to 4.0.7.release, all versions starting from 4.1-alpha0 up to 4.1.1.release",
          "cvss_v2": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-22",
            "CWE-937"
          ],
          "date": "2019-07-13",
          "description": "Directory traversal vulnerability in this package allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling.",
          "fixed_versions": [
            "3.2.12.RELEASE",
            "4.0.8.RELEASE",
            "4.1.2.RELEASE"
          ],
          "identifier": "CVE-2014-3625",
          "identifiers": [
            "CVE-2014-3625"
          ],
          "not_impacted": "All versions before 3.2-alpha0, all versions after 3.2.11.release before 4.0-alpha0, all versions after 4.0.7.release before 4.1-alpha0, all versions after 4.1.1.release",
          "package_slug": "maven/org.springframework/spring-webmvc",
          "pubdate": "2014-11-20",
          "solution": "Upgrade to versions 3.2.12.RELEASE, 4.0.8.RELEASE, 4.1.2.RELEASE or above.",
          "title": "Directory traversal flaw",
          "urls": [
            "http://www.pivotal.io/security/cve-2014-3625",
            "https://bugzilla.redhat.com/CVE-2014-3625",
            "https://jira.spring.io/browse/SPR-12354"
          ],
          "uuid": "c1ca1267-b315-452a-a027-1ca247ad6a90"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "3.0.7",
                "versionStartIncluding": "3.0.4",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:pivotal_software:spring_framework:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "3.1.4",
                "versionStartIncluding": "3.1.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:pivotal_software:spring_framework:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "3.2.12",
                "versionStartIncluding": "3.2.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:pivotal_software:spring_framework:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "4.0.8",
                "versionStartIncluding": "4.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:pivotal_software:spring_framework:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "4.1.2",
                "versionStartIncluding": "4.1.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2014-3625"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-22"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://jira.spring.io/browse/SPR-12354",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://jira.spring.io/browse/SPR-12354"
            },
            {
              "name": "http://www.pivotal.io/security/cve-2014-3625",
              "refsource": "CONFIRM",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://www.pivotal.io/security/cve-2014-3625"
            },
            {
              "name": "RHSA-2015:0236",
              "refsource": "REDHAT",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "http://rhn.redhat.com/errata/RHSA-2015-0236.html"
            },
            {
              "name": "RHSA-2015:0720",
              "refsource": "REDHAT",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "http://rhn.redhat.com/errata/RHSA-2015-0720.html"
            },
            {
              "name": "[debian-lts-announce] 20190713 [SECURITY] [DLA 1853-1] libspring-java security update",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.debian.org/debian-lts-announce/2019/07/msg00012.html"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": true,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        }
      },
      "lastModifiedDate": "2022-04-11T17:16Z",
      "publishedDate": "2014-11-20T17:50Z"
    }
  }
}