Spring框架存在路徑穿越漏洞，恐對網頁應用程式造成資安風險
支付動態 · 2024-10-18
本週開發團隊公告Spring Framework出現路徑穿越漏洞CVE-2024-38819，並指出該漏洞影響所有版本的Spring Framework，呼籲用戶要儘速套用新版程式因應
10月17日Spring開發團隊發布資安公告，指出Spring Framework存在路徑穿越漏洞CVE-2024-38819，該漏洞影響6.1.13、6.0.24、5.3.40及以下版本，他們推出6.1.14、6.0.25、5.3.41版進行修補。
針對這項漏洞出現的原因，該公司表示，應用程式藉由網頁框架WebMvc.fn或WebFlux.fn提供靜態資源的過程中，容易受到路徑穿越攻擊，攻擊者只要發送惡意HTTP請求，就有機會藉由正在運作的Spring應用程式處理程序，取得檔案系統的任意檔案。
他們補充說明，這項漏洞相當類似於一個月前修補的CVE-2024-38816（CVSS風險為7.5分）。但究竟CVE-2024-38819有多嚴重？他們並未提供風險評分資訊。
熱門文章
Institutional Academy that exceeded expectations marked the opening of GAT CDMX
Online Game
Online gambling, crypto pose ongoing money laundering risks in Philippines, analyst says
Southeast Asia
New Jersey July Gambling Revenue Hits $606M, Sweeps Casinos Banned
Regulation
1spin4win grows its Latin American presence by partnering with Fortuna Juegos
Online Game
GAT CDMX 2025 Institutional Academy: Leaders and Experts Analyze the Present and Future of the Gaming Industry in Mexico and Lat
Sports Game
PropellerAds Shared a New iGaming Case Study: 97,674 Installs and 12,701 Deposits in 3 Months
Marketing
GAT Expo CDMX 2026 Kicks Off Today in Mexico with a Sold-Out Opening Reception at Big Bola Casino Santa Fe
Marketing
DB Gaming Is One of Asia’s Top-Tier Game Solution Providers, Recognized as a Pioneer in the Asian Gaming Industry.
Marketing
Full House at GAT Expo Cartagena 2026 Academic Agenda
Online Game
Brazil Proposes Raising Gambling Tax Rate to 24%, With Revenue Allocated to Social Security and Healthcare
Regulation
Vietnam's tightening online gaming policy creates new market opportunities
Southeast Asia
Global Game Connect (GGC) 2027 Officially Opens Sponsorship & Exhibition Opportunities in Sri Lanka!
HUIDU Focus
UK MPs reopen 2025 gambling inquiry as reform stalls
Regulation
PropellerAds Positions Itself as a Go-To Traffic Source for iGaming Advertisers Ahead of a High-Demand Season
Marketing
That’s a Wrap: AffPapa Conference Madrid 2026 Highlights
Online Game
