VulnerableCode Package Details - pkg:maven/org.springframework/spring-core@4.0.0.RELEASE

Vulnerabilities affecting this package (18)

Advisory	Summary	Fixed in package version
CVE-2018-1272	Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support …	4.3.15.RELEASE Vulnerable 4.3.16.RELEASE Vulnerable 4.3.17.RELEASE Vulnerable 4.3.18.RELEASE Vulnerable 4.3.20.RELEASE Vulnerable 5.0.5.RELEASE Vulnerable 5.0.6.RELEASE Vulnerable 5.0.7.RELEASE Vulnerable 5.0.13.RELEASE Vulnerable 5.0.16.RELEASE Vulnerable 5.1.0.RELEASE Vulnerable 5.1.1.RELEASE Vulnerable 5.1.13.RELEASE Vulnerable 5.1.14.RELEASE Vulnerable 5.1.17.RELEASE Vulnerable 5.2.0.RELEASE Vulnerable 5.2.1.RELEASE Vulnerable 5.2.3.RELEASE Vulnerable 5.2.4.RELEASE Vulnerable 4.3.19.RELEASE Vulnerable 4.3.21.RELEASE Vulnerable 4.3.22.RELEASE Vulnerable 4.3.23.RELEASE Vulnerable 4.3.24.RELEASE Vulnerable 4.3.25.RELEASE Vulnerable 4.3.26.RELEASE Vulnerable 5.0.8.RELEASE Vulnerable 5.0.9.RELEASE Vulnerable 5.0.10.RELEASE Vulnerable 5.0.11.RELEASE Vulnerable 5.0.12.RELEASE Vulnerable 5.0.14.RELEASE Vulnerable 5.0.15.RELEASE Vulnerable 5.1.2.RELEASE Vulnerable 5.1.3.RELEASE Vulnerable 5.1.4.RELEASE Vulnerable 5.1.5.RELEASE Vulnerable 5.1.6.RELEASE Vulnerable 5.1.7.RELEASE Vulnerable 5.1.8.RELEASE Vulnerable 5.1.9.RELEASE Vulnerable 5.1.10.RELEASE Vulnerable 5.1.11.RELEASE Vulnerable 5.1.12.RELEASE Vulnerable 5.1.15.RELEASE Vulnerable 5.1.16.RELEASE Vulnerable 5.2.2.RELEASE Vulnerable 5.2.5.RELEASE Vulnerable 5.2.6.RELEASE Vulnerable 5.2.7.RELEASE Vulnerable 5.2.8.RELEASE Vulnerable
GHSA-rhcg-rwhx-qj3j Aliases: CVE-2014-3578	Improper Limitation of a Pathname to a Restricted Directory in Spring Framework Directory traversal vulnerability in Pivotal Spring Framework 3.x …	There are no reported fixed by versions.
CVE-2022-22971 Aliases: GHSA-rqph-vqwm-22vc	Allocation of Resources Without Limits or Throttling In spring framework versions prior to 5.3.20+, 5.2.22+ and old unsupported versions, application …	5.3.20 Vulnerable 5.2.22.RELEASE Vulnerable
CVE-2023-20861 Aliases: GHSA-564r-hj7v-mcr5	Spring Framework vulnerable to denial of service via specially crafted SpEL expression In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 …	5.3.26 Vulnerable 6.0.7 Vulnerable 5.2.23.RELEASE Vulnerable
CVE-2020-5421	Remote file disclosure In Spring Framework the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser …	5.1.18.RELEASE Vulnerable 5.0.19.RELEASE Vulnerable 4.3.29.RELEASE Vulnerable 5.2.9.RELEASE Vulnerable
CVE-2022-22970 Aliases: GHSA-hh26-6xwr-ggv7	Allocation of Resources Without Limits or Throttling In spring framework versions prior to 5.3.20+, 5.2.22+ and old unsupported versions, applications …	5.3.20 Vulnerable 5.2.22.RELEASE Vulnerable
CVE-2022-22968 Aliases: GHSA-g5mm-vmx4-3rg7	Improper Handling of Case Sensitivity In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the …	5.3.19 Vulnerable
GHSA-pgf9-h69p-pcgf Aliases: CVE-2015-5211	Files or Directories Accessible to External Parties in org.springframework:spring-core Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to …	There are no reported fixed by versions.
GHSA-g8hw-794c-4j9g Aliases: CVE-2018-1271	Path Traversal in org.springframework:spring-core Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported …	There are no reported fixed by versions.
GHSA-rcpf-vj53-7h2m Aliases: CVE-2018-1257	Denial of Service in org.springframework:spring-core Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported …	There are no reported fixed by versions.
GHSA-8crv-49fr-2h6j Aliases: CVE-2016-5007	Spring Security and Spring Framework may not recognize certain paths that should be protected Both Spring Security 3.2.x, 4.0.x, 4.1.0 …	There are no reported fixed by versions.
GHSA-4487-x383-qpph Aliases: CVE-2018-1272	Possible privilege escalation in org.springframework:spring-core Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older …	There are no reported fixed by versions.
CVE-2023-20863 Aliases: GHSA-wxqc-pxw9-g2p8	Spring Framework vulnerable to denial of service In spring framework versions prior to 5.2.24 release+,5.3.27+ and 6.0.8+, it is possible …	5.3.27 Vulnerable 6.0.8 Vulnerable 5.2.24.RELEASE Vulnerable 5.3.27 Vulnerable 6.0.8 Vulnerable 5.2.24.RELEASE Vulnerable
CVE-2016-5007	Spring Security / MVC Path Matching Inconsistency This package rely on URL pattern mappings for authorization and for mapping requests …	4.3.1.RELEASE Vulnerable 4.3.1.RELEASE Vulnerable
CVE-2015-3192 Aliases: GHSA-6v7w-535j-rq5m	Improper Restriction of Operations within the Bounds of a Memory Buffer Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 …	There are no reported fixed by versions.
CVE-2018-1275 Aliases: GHSA-3rmv-2pg5-xvqj	Improper Control of Generation of Code ('Code Injection') Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to …	There are no reported fixed by versions.
GMS-2022-559 Aliases: CVE-2022-22965 GHSA-36p3-wjmg-h94x	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework:spring-core.	5.3.18 Vulnerable 5.3.18 Vulnerable
GHSA-659m-px2c-25wj Aliases: CVE-2026-41848	Spring Framework Denial of Service via AntPathMatcher Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack …	7.0.8 Not vulnerable 6.2.19 Not vulnerable

Next non-vulnerable version	6.2.19
Latest non-vulnerable version	7.0.8
Risk score	3.9

Advisory	Summary	Aliases
CVE-2015-0201	The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to …
CVE-2013-6429	The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, …