Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/org.springframework.security/spring-security-core@4.1-alpha0
Typemaven
Namespaceorg.springframework.security
Namespring-security-core
Version4.1-alpha0
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version5.7.14
Latest_non_vulnerable_version6.5.4
Affected_by_vulnerabilities
0
url VCID-deuk-emca-3kgr
vulnerability_id VCID-deuk-emca-3kgr
summary An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1. Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded "/" to a request, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. The unexpected presence of path parameters can cause a constraint to be bypassed. Users of Apache Tomcat (all current versions) are not affected by this vulnerability since Tomcat follows the guidance previously provided by the Servlet Expert group and strips path parameters from the value returned by getContextPath(), getServletPath(), and getPathInfo(). Users of other Servlet containers based on Apache Tomcat may or may not be affected depending on whether or not the handling of path parameters has been modified. Users of IBM WebSphere Application Server 8.5.x are known to be affected. Users of other containers that implement the Servlet specification may be affected.
references
0
reference_url https://access.redhat.com/errata/RHSA-2017:1832
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://access.redhat.com/errata/RHSA-2017:1832
1
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-9879.json
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-9879.json
2
reference_url https://api.first.org/data/v1/epss?cve=CVE-2016-9879
reference_id
reference_type
scores
0
value 0.00322
scoring_system epss
scoring_elements 0.5531
published_at 2026-04-21T12:55:00Z
1
value 0.00322
scoring_system epss
scoring_elements 0.55267
published_at 2026-04-07T12:55:00Z
2
value 0.00322
scoring_system epss
scoring_elements 0.55318
published_at 2026-04-09T12:55:00Z
3
value 0.00322
scoring_system epss
scoring_elements 0.55329
published_at 2026-04-11T12:55:00Z
4
value 0.00322
scoring_system epss
scoring_elements 0.55308
published_at 2026-04-12T12:55:00Z
5
value 0.00322
scoring_system epss
scoring_elements 0.55289
published_at 2026-04-13T12:55:00Z
6
value 0.00322
scoring_system epss
scoring_elements 0.55327
published_at 2026-04-16T12:55:00Z
7
value 0.00322
scoring_system epss
scoring_elements 0.55331
published_at 2026-04-18T12:55:00Z
8
value 0.00322
scoring_system epss
scoring_elements 0.55162
published_at 2026-04-01T12:55:00Z
9
value 0.00322
scoring_system epss
scoring_elements 0.55263
published_at 2026-04-02T12:55:00Z
10
value 0.00322
scoring_system epss
scoring_elements 0.55286
published_at 2026-04-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2016-9879
3
reference_url https://github.com/spring-projects/spring-security/commit/666e356ebc479194ba51e43bb99fc42f849b6175
reference_id
reference_type
scores
url https://github.com/spring-projects/spring-security/commit/666e356ebc479194ba51e43bb99fc42f849b6175
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2016-9879
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2016-9879
5
reference_url http://www.securityfocus.com/bid/95142
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.securityfocus.com/bid/95142
6
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1409838
reference_id 1409838
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1409838
7
reference_url https://pivotal.io/security/cve-2016-9879
reference_id CVE-2016-9879
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://pivotal.io/security/cve-2016-9879
8
reference_url https://github.com/advisories/GHSA-v35c-49j6-q8hq
reference_id GHSA-v35c-49j6-q8hq
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-v35c-49j6-q8hq
fixed_packages
0
url pkg:maven/org.springframework.security/spring-security-core@4.1.4.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@4.1.4.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cden-3spy-pyhz
1
vulnerability VCID-dwcq-d6nf-1ubn
2
vulnerability VCID-hedq-eav6-4fee
3
vulnerability VCID-qpxj-fzta-v7bs
4
vulnerability VCID-u6vb-w2bu-ykfk
5
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@4.1.4.RELEASE
1
url pkg:maven/org.springframework.security/spring-security-core@4.2.1.RELEASE
purl pkg:maven/org.springframework.security/spring-security-core@4.2.1.RELEASE
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cden-3spy-pyhz
1
vulnerability VCID-dwcq-d6nf-1ubn
2
vulnerability VCID-f3g5-hamr-6yar
3
vulnerability VCID-hedq-eav6-4fee
4
vulnerability VCID-pz7c-p4ze-kfhc
5
vulnerability VCID-qpxj-fzta-v7bs
6
vulnerability VCID-u6vb-w2bu-ykfk
7
vulnerability VCID-xdnd-ar9s-afd8
8
vulnerability VCID-yeaf-ta2h-p7c1
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@4.2.1.RELEASE
aliases CVE-2016-9879, GHSA-v35c-49j6-q8hq
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-deuk-emca-3kgr
Fixing_vulnerabilities
Risk_score4.0
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-core@4.1-alpha0