Polaris

org.springframework/spring-webmvc

Back to Components
Spring Web MVC
mavenframework

Overview

Canonical component data stored by Polaris.

Version

5.0.4.RELEASE

Package Manager

maven

Type

framework

Systems

1

Licenses
Apache-2.0
Direct Dependencies

1

Technology

Not linked

External Signals
deps.dev endoflife.date OSV.dev
Package URL

pkg:maven/org.springframework/[email protected]?type=jar

Maintenance

Derived from available component and registry data

Aging
Confidence

Low

Version Age

3090 days

Update Status

Unknown

Recent Activity

Yes

Reasons
Very old versionUnsupported versionUpdate status unknown

Lifecycle

Source: endoflife.date

Unknown
No lifecycle match available
The mapped product was not available from the third-party lifecycle source.
Open endoflife.date

Registry

Source: deps.dev

Available
Ecosystem

maven

Latest Version

7.0.8

Published

2/19/2018

Recent Releases

24

Advisories

12

Open deps.dev

Known Vulnerabilities

Source: OSV.dev

12 found

GHSA-36p3-wjmg-h94x

Remote Code Execution in Spring Framework

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Affected Versions
all versions before 5.2.20.RELEASE>= 5.3.0, before 5.3.18all versions before 2.5.12 +1 more
Open advisory

GHSA-3chg-m5w7-qfv5

Spring Framework Cross-site Scripting via JavaScriptUtils

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Affected Versions
>= 7.0.0, before 7.0.8>= 6.2.0, before 6.2.196.1.0 - 6.1.21 +1 more
Open advisory

GHSA-6p4f-wcwh-5vvm

Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected Versions
>= 7.0.0, before 7.0.7>= 6.2.0, before 6.2.186.1.0 - 6.1.26 +1 more
Open advisory

GHSA-72pg-x5f8-j25j

Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Versions
>= 7.0.0, before 7.0.8>= 6.2.0, before 6.2.196.1.0 - 6.1.21 +1 more
Open advisory

GHSA-8wx2-9q48-vm9r

RFD attack via Content-Disposition header sourced from request input by Spring MVC or Spring WebFlux Application

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Versions
>= 5.2.0.RELEASE, before 5.2.3.RELEASE>= 5.1.0.RELEASE, before 5.1.13.RELEASE>= 5.0.0.RELEASE, before 5.0.16.RELEASE
Open advisory

GHSA-957g-f97v-vppc

Spring Framework Cross-site Scripting via JSP Form Tags

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Affected Versions
>= 7.0.0, before 7.0.8>= 6.2.0, before 6.2.196.1.0 - 6.1.21 +1 more
Open advisory

GHSA-cjpg-rgq5-fr37

Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected Versions
>= 7.0.0, before 7.0.8>= 6.2.0, before 6.2.196.1.0 - 6.1.21 +1 more
Open advisory

GHSA-g5vr-rgqm-vf78

Spring Framework Path Traversal vulnerability

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Versions
>= 6.1.0, before 6.1.14<= 5.3.396.0.0 - 6.0.23
Open advisory

GHSA-h3qp-gqrc-q736

Spring Framework Open Redirect in Spring MVC and WebFlux

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected Versions
>= 7.0.0, before 7.0.8>= 6.2.0, before 6.2.196.1.0 - 6.1.21 +1 more
Open advisory

GHSA-mq64-j8f9-9gcj

Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Versions
>= 7.0.0, before 7.0.8>= 6.2.0, before 6.2.196.1.0 - 6.1.21 +1 more
Open advisory

GHSA-wg35-8jpf-2xv3

Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Affected Versions
>= 7.0.0, before 7.0.7>= 6.2.0, before 6.2.186.1.0 - 6.1.26 +1 more
Open advisory

GHSA-x23c-287f-qqv5

Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Versions
>= 7.0.0, before 7.0.8>= 6.2.0, before 6.2.196.1.0 - 6.1.21 +1 more
Open advisory
Open OSV.dev

Security

Source: OpenSSF Scorecard

Unavailable
No security scorecard available
This component does not have a repository reference for OpenSSF Scorecard lookup.

Dependencies

1 direct dependency

Global view