VulnerableCode Package Details - pkg:maven/org.springframework.boot/spring-boot@1.5.0

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:maven/org.springframework.boot/spring-boot@1.5.0

Essentials
History (1)

purl	pkg:maven/org.springframework.boot/spring-boot@1.5.0
Tags	Ghost

Next non-vulnerable version	3.0.13
Latest non-vulnerable version	3.4.5
Risk	3.1

Vulnerabilities affecting this package (1)

Vulnerability	Summary	Fixed by
VCID-hek3-n96t-bydw Aliases: CVE-2018-1196 GHSA-xx65-cc7g-9pfp	Symlink privilege escalation attack via Spring Boot launch script Spring Boot supports an embedded launch script that can be used to easily run the application as a systemd or init.d linux service. The script included with Spring Boot is susceptible to a symlink attack which allows the `run_user` to overwrite and take ownership of any file on the same system. In order to instigate the attack, the application must be installed as a service and the `run_user` requires shell access to the server.	1.5.10 Affected by 0 other vulnerabilities. 1.5.10.RELEASE Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-hek3-n96t-bydw
Aliases:
CVE-2018-1196
GHSA-xx65-cc7g-9pfp

Symlink privilege escalation attack via Spring Boot launch script Spring Boot supports an embedded launch script that can be used to easily run the application as a systemd or init.d linux service. The script included with Spring Boot is susceptible to a symlink attack which allows the `run_user` to overwrite and take ownership of any file on the same system. In order to instigate the attack, the application must be installed as a service and the `run_user` requires shell access to the server.

1.5.10
Affected by 0 other vulnerabilities.

1.5.10.RELEASE
Affected by 3 other vulnerabilities.

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T15:57:02.172903+00:00	GHSA Importer	Affected by	VCID-hek3-n96t-bydw	https://github.com/advisories/GHSA-xx65-cc7g-9pfp	38.0.0