CVE-2018-1271
published 2018-04-06CVE-2018-1271: Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to…
PriorityP354medium5.9CVSS 3.1
AVNACHPRNUINSUCHINAN
EXPLOIT
EPSS
35.68%
98.3th percentile
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.
Affected
74 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libspring-java | — | — |
| oracle | application_testing_suite | — | — |
| oracle | application_testing_suite | — | — |
| oracle | application_testing_suite | — | — |
| oracle | application_testing_suite | — | — |
| oracle | big_data_discovery | — | — |
| oracle | communications_converged_application_server | < 7.0.0.1 | 7.0.0.1 |
| oracle | communications_diameter_signaling_router | < 8.3 | 8.3 |
| oracle | communications_performance_intelligence_center | < 10.2.1 | 10.2.1 |
| oracle | communications_policy_management | — | — |
| oracle | communications_services_gatekeeper | < 6.1.0.4.0 | 6.1.0.4.0 |
| oracle | enterprise_manager_ops_center | — | — |
| oracle | enterprise_manager_ops_center | — | — |
| oracle | goldengate_for_big_data | — | — |
| oracle | goldengate_for_big_data | — | — |
| oracle | goldengate_for_big_data | — | — |
| oracle | health_sciences_information_manager | — | — |
| oracle | healthcare_master_person_index | — | — |
| oracle | healthcare_master_person_index | — | — |
| oracle | insurance_calculation_engine | — | — |
| oracle | insurance_calculation_engine | — | — |
| oracle | insurance_calculation_engine | — | — |
| oracle | insurance_calculation_engine | 11.0.0 – 11.3.1 | — |
| oracle | insurance_rules_palette | — | — |
| oracle | insurance_rules_palette | — | — |
Detection & IOCsextracted from sources · hover to see the quote
url{{BaseURL}}/static/%255c%255c..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/windows/win.ini
url{{BaseURL}}/spring-mvc-showcase/resources/%255c%255c..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/windows/win.ini
- →Look for HTTP GET requests containing double-URL-encoded backslash sequences (%255c) combined with directory traversal patterns (..%255c/) targeting static resource endpoints such as /static/ or /spring-mvc-showcase/resources/
- →Successful exploitation returns HTTP 200 with the string 'for 16-bit app support' in the response body, indicating the contents of windows/win.ini were read via directory traversal
- →Vulnerability is Windows-specific: only triggered when Spring MVC serves static resources from a Windows file system (not classpath or ServletContext) ↗
- →Applications that use versions of Spring Security patched for CVE-2018-1199 are not affected by this vulnerability ↗
- ·Exploitation requires the application to be running on Windows and configured to serve static resources from the file system; classpath- or ServletContext-based resource serving is not vulnerable ↗
- ·Affected versions are Spring Framework 5.0.x prior to 5.0.5 and 4.3.x prior to 4.3.15; older unsupported versions are also affected ↗
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
vendor_debian5.9LOW
vendor_redhat5.9MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Path Traversal in org.springframework:spring-core
ghsa·2018-10-17
CVE-2018-1271 [MEDIUM] CWE-22 Path Traversal in org.springframework:spring-core
Path Traversal in org.springframework:spring-core
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.
OSV
Path Traversal in org.springframework:spring-core
osv·2018-10-17
CVE-2018-1271 [MEDIUM] Path Traversal in org.springframework:spring-core
Path Traversal in org.springframework:spring-core
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.
Red Hat
spring-framework: Directory traversal vulnerability with static resources on Windows filesystems
vendor_redhat·2018-04-05·CVSS 5.9
CVE-2018-1271 [MEDIUM] CWE-22 spring-framework: Directory traversal vulnerability with static resources on Windows filesystems
spring-framework: Directory traversal vulnerability with static resources on Windows filesystems
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.
Package: springframework (Red Hat Enterprise Linux 8) - Not affected
Package: spring (Red Hat JBoss A-MQ 6) - Out of support scope
Package: spring (Red Hat JBoss BRMS 5) - Out of support scope
Package: spring (Red Hat JBoss Data Virtualization 6) - Out of support sco
Debian
CVE-2018-1271: libspring-java - Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 a...
vendor_debian·2018·CVSS 5.9
CVE-2018-1271 [MEDIUM] CVE-2018-1271: libspring-java - Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 a...
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
No detection rules found.
Nuclei
Spring MVC Framework - Local File Inclusion
nuclei·CVSS 5.9
CVE-2018-1271 [MEDIUM] Spring MVC Framework - Local File Inclusion
Spring MVC Framework - Local File Inclusion
Spring MVC Framework versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported are vulnerable to local file inclusion because they allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). A malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.
Template:
id: CVE-2018-1271
info:
name: Spring MVC Framework - Local File Inclusion
author: hetroublemakr
severity: medium
description: Spring MVC Framework versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported are vulnerable to local file inclusion because they allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). A malici
Greynoiseio
NoiseLetter October 2025
blogs_greynoiseio
NoiseLetter October 2025
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
HackerOne
Path Traversal issue at https://████/blaze/
hackerone·2022-10-06·CVSS 7.5
[HIGH] Path Traversal issue at https://████/blaze/
Path Traversal issue at https://████/blaze/
The researcher reported that a Sony endpoint was vulnerable to a path traversal vulnerability due to CVE-2018–1271. The researcher used the path traversal vulnerability to access a win.ini file on the vulnerable endpoint.
Bugzilla
CVE-2018-1271 spring-framework: Directory traversal vulnerability with static resources on Windows filesystems
bugzilla·2018-04-24·CVSS 5.3
CVE-2018-1271 [MEDIUM] CVE-2018-1271 spring-framework: Directory traversal vulnerability with static resources on Windows filesystems
CVE-2018-1271 spring-framework: Directory traversal vulnerability with static resources on Windows filesystems
Spring Framework versions 5.0 to 5.0.4, 4.3 to 4.3.14, and older unsupported versions allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.
This vulnerability does not affect applications that use versions of Spring Security patched for CVE-2018-1199.
External Reference:
https://pivotal.io/security/cve-2018-1271
Discussion:
This issue has been addressed in the following products:
Red Hat Openshift Application Ru
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlhttp://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlhttp://www.securityfocus.com/bid/103699https://access.redhat.com/errata/RHSA-2018:1320https://access.redhat.com/errata/RHSA-2018:2669https://access.redhat.com/errata/RHSA-2018:2939https://pivotal.io/security/cve-2018-1271https://www.oracle.com/security-alerts/cpujul2020.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.htmlhttps://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlhttps://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlhttp://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlhttp://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlhttp://www.securityfocus.com/bid/103699https://access.redhat.com/errata/RHSA-2018:1320https://access.redhat.com/errata/RHSA-2018:2669https://access.redhat.com/errata/RHSA-2018:2939https://pivotal.io/security/cve-2018-1271https://www.oracle.com/security-alerts/cpujul2020.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.htmlhttps://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlhttps://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
2018-04-06
Published