In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.

Affected: Maven: org.springframework:spring-web

In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.

activemq: improper authentication allows MITM attack cxf: XSS via the styleSheetPath apache-flink: directory traversal attack allows remote file writing through the REST API groovy: OS temporary directory leads to information disclosure XStream: remote code execution due to insecure XML deserialization when relying on blocklists cron-utils: template injection allows attackers to inject arbitrary Java EL expressions leading to remote code execution XStream: Server-Side Forgery Request vulnerability can be activated when unmarshalling XStream: arbitrary file deletion on the local host when unmarshalling californium-core: DTLS - DoS vulnerability for certificate based handshakes undertow: special character in query results in server errors bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible kotlin: vulnerable Java API was used for temporary file and folder creation which could result in information disclosure fabric8-kubernetes-client: vulnerable to a path traversal leading to integrity and availability compromise spring-web: (re)creating the temporary storage directory could result in a privilege escalation within WebFlux application pdfbox: infinite loop while loading a crafted PDF file pdfbox: OutOfMemory-Exception while loading a crafted PDF file CXF: Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter pdfbox: OutOfMemory-Exception while loading a crafted PDF file

Affected: Ubuntu:Pro:16.04:LTS: libspring-java

In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.