cvelistv5 - cve-2025-41242

CVE-2025-41242 (GCVE-0-2025-41242)

Vulnerability from cvelistv5

Published

2025-08-18 08:47

Modified

2025-08-18 11:21

Severity ?

5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: * the application is deployed as a WAR or with an embedded Servlet container * the Servlet container does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization * the application serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title with Spring resource handling We have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.

References

►

URL

Tags

security@vmware.com

http://spring.io/security/cve-2025-41242

Impacted products

	Vendor	Product	Version
	VMware	Spring Framework	Version: 6.2.x Version: 6.1.x Version: 5.3.x

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-41242",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-18T11:20:32.641979Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-18T11:21:06.288Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "Spring Framework",
          "product": "Spring Framework",
          "vendor": "VMware",
          "versions": [
            {
              "lessThan": "6.2.10",
              "status": "affected",
              "version": "6.2.x",
              "versionType": "OSS"
            },
            {
              "lessThan": "6.1.22",
              "status": "affected",
              "version": "6.1.x",
              "versionType": "commercial"
            },
            {
              "lessThan": "5.3.44",
              "status": "affected",
              "version": "5.3.x",
              "versionType": "commercial"
            }
          ]
        }
      ],
      "datePublic": "2025-08-14T20:41:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSpring Framework MVC applications can be vulnerable to a \u201cPath Traversal Vulnerability\u201d when deployed on a non-compliant Servlet container.\u003c/p\u003e\u003cp\u003eAn application can be vulnerable when all the following are true:\u003c/p\u003e\u003cul\u003e\u003cli\u003ethe application is deployed as a WAR or with an embedded Servlet container\u003c/li\u003e\u003cli\u003ethe Servlet container \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization\"\u003edoes not reject suspicious sequences\u003c/a\u003e\u003c/li\u003e\u003cli\u003ethe application \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title\"\u003eserves static resources\u003c/a\u003e\u0026nbsp;with Spring resource handling\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eWe have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "Spring Framework MVC applications can be vulnerable to a \u201cPath Traversal Vulnerability\u201d when deployed on a non-compliant Servlet container.\n\nAn application can be vulnerable when all the following are true:\n\n  *  the application is deployed as a WAR or with an embedded Servlet container\n  *  the Servlet container  does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization \n  *  the application  serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title \u00a0with Spring resource handling\n\n\nWe have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-18T08:47:07.427Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "http://spring.io/security/cve-2025-41242"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2025-41242",
    "datePublished": "2025-08-18T08:47:07.427Z",
    "dateReserved": "2025-04-16T09:30:17.799Z",
    "dateUpdated": "2025-08-18T11:21:06.288Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-41242\",\"sourceIdentifier\":\"security@vmware.com\",\"published\":\"2025-08-18T09:15:28.637\",\"lastModified\":\"2025-08-18T20:16:28.750\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Spring Framework MVC applications can be vulnerable to a \u201cPath Traversal Vulnerability\u201d when deployed on a non-compliant Servlet container.\\n\\nAn application can be vulnerable when all the following are true:\\n\\n  *  the application is deployed as a WAR or with an embedded Servlet container\\n  *  the Servlet container  does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization \\n  *  the application  serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title \u00a0with Spring resource handling\\n\\n\\nWe have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.\"},{\"lang\":\"es\",\"value\":\"Las aplicaciones Spring Framework MVC pueden ser vulnerables a una \\\"Vulnerabilidad de Path Traversal\\\" cuando se implementan en un contenedor de Servlet no compatible. Una aplicaci\u00f3n puede ser vulnerable cuando se cumplen todas las siguientes condiciones: * la aplicaci\u00f3n se implementa como un WAR o con un contenedor de Servlet integrado * el contenedor de Servlet no rechaza secuencias sospechosas https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization * la aplicaci\u00f3n sirve recursos est\u00e1ticos https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title con el manejo de recursos de Spring Hemos verificado que las aplicaciones implementadas en Apache Tomcat o Eclipse Jetty no son vulnerables, siempre que las funciones de seguridad predeterminadas no est\u00e9n deshabilitadas en la configuraci\u00f3n. Dado que no podemos comprobar los exploits en todos los contenedores de Servlet y variantes de configuraci\u00f3n, recomendamos encarecidamente actualizar su aplicaci\u00f3n.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@vmware.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":3.6}]},\"references\":[{\"url\":\"http://spring.io/security/cve-2025-41242\",\"source\":\"security@vmware.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-41242\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-08-18T11:20:32.641979Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-08-18T11:20:36.420Z\"}}], \"cna\": {\"title\": \"CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"VMware\", \"product\": \"Spring Framework\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.2.x\", \"lessThan\": \"6.2.10\", \"versionType\": \"OSS\"}, {\"status\": \"affected\", \"version\": \"6.1.x\", \"lessThan\": \"6.1.22\", \"versionType\": \"commercial\"}, {\"status\": \"affected\", \"version\": \"5.3.x\", \"lessThan\": \"5.3.44\", \"versionType\": \"commercial\"}], \"packageName\": \"Spring Framework\", \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2025-08-14T20:41:00.000Z\", \"references\": [{\"url\": \"http://spring.io/security/cve-2025-41242\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Spring Framework MVC applications can be vulnerable to a \\u201cPath Traversal Vulnerability\\u201d when deployed on a non-compliant Servlet container.\\n\\nAn application can be vulnerable when all the following are true:\\n\\n  *  the application is deployed as a WAR or with an embedded Servlet container\\n  *  the Servlet container  does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization \\n  *  the application  serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title \\u00a0with Spring resource handling\\n\\n\\nWe have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eSpring Framework MVC applications can be vulnerable to a \\u201cPath Traversal Vulnerability\\u201d when deployed on a non-compliant Servlet container.\u003c/p\u003e\u003cp\u003eAn application can be vulnerable when all the following are true:\u003c/p\u003e\u003cul\u003e\u003cli\u003ethe application is deployed as a WAR or with an embedded Servlet container\u003c/li\u003e\u003cli\u003ethe Servlet container \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization\\\"\u003edoes not reject suspicious sequences\u003c/a\u003e\u003c/li\u003e\u003cli\u003ethe application \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title\\\"\u003eserves static resources\u003c/a\u003e\u0026nbsp;with Spring resource handling\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eWe have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.\u003c/p\u003e\u003cbr\u003e\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"dcf2e128-44bd-42ed-91e8-88f912c1401d\", \"shortName\": \"vmware\", \"dateUpdated\": \"2025-08-18T08:47:07.427Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-41242\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-08-18T11:21:06.288Z\", \"dateReserved\": \"2025-04-16T09:30:17.799Z\", \"assignerOrgId\": \"dcf2e128-44bd-42ed-91e8-88f912c1401d\", \"datePublished\": \"2025-08-18T08:47:07.427Z\", \"assignerShortName\": \"vmware\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

fkie_cve-2025-41242

Vulnerability from fkie_nvd

Published

2025-08-18 09:15

Modified

2025-08-18 20:16

Severity ?

5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

References

▶	URL	Tags
	security@vmware.com	http://spring.io/security/cve-2025-41242

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Spring Framework MVC applications can be vulnerable to a \u201cPath Traversal Vulnerability\u201d when deployed on a non-compliant Servlet container.\n\nAn application can be vulnerable when all the following are true:\n\n  *  the application is deployed as a WAR or with an embedded Servlet container\n  *  the Servlet container  does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization \n  *  the application  serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title \u00a0with Spring resource handling\n\n\nWe have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application."
    },
    {
      "lang": "es",
      "value": "Las aplicaciones Spring Framework MVC pueden ser vulnerables a una \"Vulnerabilidad de Path Traversal\" cuando se implementan en un contenedor de Servlet no compatible. Una aplicaci\u00f3n puede ser vulnerable cuando se cumplen todas las siguientes condiciones: * la aplicaci\u00f3n se implementa como un WAR o con un contenedor de Servlet integrado * el contenedor de Servlet no rechaza secuencias sospechosas https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization * la aplicaci\u00f3n sirve recursos est\u00e1ticos https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title con el manejo de recursos de Spring Hemos verificado que las aplicaciones implementadas en Apache Tomcat o Eclipse Jetty no son vulnerables, siempre que las funciones de seguridad predeterminadas no est\u00e9n deshabilitadas en la configuraci\u00f3n. Dado que no podemos comprobar los exploits en todos los contenedores de Servlet y variantes de configuraci\u00f3n, recomendamos encarecidamente actualizar su aplicaci\u00f3n."
    }
  ],
  "id": "CVE-2025-41242",
  "lastModified": "2025-08-18T20:16:28.750",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6,
        "source": "security@vmware.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-08-18T09:15:28.637",
  "references": [
    {
      "source": "security@vmware.com",
      "url": "http://spring.io/security/cve-2025-41242"
    }
  ],
  "sourceIdentifier": "security@vmware.com",
  "vulnStatus": "Awaiting Analysis"
}

ghsa-r936-gwx5-v52f

Vulnerability from github

Published

2025-08-18 09:31

Modified

2025-08-18 22:27

Severity ?

5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

Spring Framework MVC Applications Path Traversal Vulnerability

Details

Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container.

An application can be vulnerable when all the following are true:

the application is deployed as a WAR or with an embedded Servlet container
the Servlet container does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization
the application serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title with Spring resource handling

We have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework:spring-webmvc"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.2.0"
            },
            {
              "fixed": "6.2.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework:spring-webmvc"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.1.0"
            },
            {
              "last_affected": "6.1.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework:spring-webmvc"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "last_affected": "6.0.29"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework:spring-webmvc"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.3.0"
            },
            {
              "last_affected": "5.3.43"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-41242"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-08-18T22:27:13Z",
    "nvd_published_at": "2025-08-18T09:15:28Z",
    "severity": "MODERATE"
  },
  "details": "Spring Framework MVC applications can be vulnerable to a \u201cPath Traversal Vulnerability\u201d when deployed on a non-compliant Servlet container.\n\nAn application can be vulnerable when all the following are true:\n\n  *  the application is deployed as a WAR or with an embedded Servlet container\n  *  the Servlet container  does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization \n  *  the application  serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title \u00a0with Spring resource handling\n\n\nWe have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.",
  "id": "GHSA-r936-gwx5-v52f",
  "modified": "2025-08-18T22:27:13Z",
  "published": "2025-08-18T09:31:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41242"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/spring-projects/spring-framework"
    },
    {
      "type": "WEB",
      "url": "http://spring.io/security/cve-2025-41242"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Spring Framework MVC Applications Path Traversal Vulnerability"
}

wid-sec-w-2025-1832

Vulnerability from csaf_certbund

Published

2025-08-13 22:00

Modified

2025-08-18 22:00

Summary

VMware Tanzu Spring Framework: Schwachstelle ermöglicht Offenlegung von Informationen

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

Das Spring Framework bietet ein Entwicklungsmodell für Java mit Infrastrukturunterstützung auf Anwendungsebene.

Angriff

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in VMware Tanzu Spring Framework ausnutzen, um Informationen offenzulegen.

Betroffene Betriebssysteme

- Linux - Sonstiges - UNIX - Windows

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Das Spring Framework bietet ein Entwicklungsmodell f\u00fcr Java mit Infrastrukturunterst\u00fctzung auf Anwendungsebene.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in VMware Tanzu Spring Framework ausnutzen, um Informationen offenzulegen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2025-1832 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-1832.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2025-1832 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-1832"
      },
      {
        "category": "external",
        "summary": "Spring Framework 6.2.10 release vom 2025-08-13",
        "url": "https://spring.io/blog/2025/08/14/spring-framework-6-2-10-release-fixes-cve-2025-41242"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisory vom 2025-08-13",
        "url": "https://spring.io/security/cve-2025-41242"
      }
    ],
    "source_lang": "en-US",
    "title": "VMware Tanzu Spring Framework: Schwachstelle erm\u00f6glicht Offenlegung von Informationen",
    "tracking": {
      "current_release_date": "2025-08-18T22:00:00.000+00:00",
      "generator": {
        "date": "2025-08-19T05:55:54.508+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.4.0"
        }
      },
      "id": "WID-SEC-W-2025-1832",
      "initial_release_date": "2025-08-13T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2025-08-13T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2025-08-18T22:00:00.000+00:00",
          "number": "2",
          "summary": "Referenz(en) aufgenommen: 2389237, EUVD-2025-25122"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c6.2.10",
                "product": {
                  "name": "VMware Tanzu Spring Framework \u003c6.2.10",
                  "product_id": "T046245"
                }
              },
              {
                "category": "product_version",
                "name": "6.2.10",
                "product": {
                  "name": "VMware Tanzu Spring Framework 6.2.10",
                  "product_id": "T046245-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vmware_tanzu:spring_framework:6.2.10"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Spring Framework"
          }
        ],
        "category": "vendor",
        "name": "VMware Tanzu"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-41242",
      "product_status": {
        "known_affected": [
          "T046245"
        ]
      },
      "release_date": "2025-08-13T22:00:00.000+00:00",
      "title": "CVE-2025-41242"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2025-41242 (GCVE-0-2025-41242)

Vulnerability from cvelistv5

fkie_cve-2025-41242

Vulnerability from fkie_nvd

ghsa-r936-gwx5-v52f

Vulnerability from github

wid-sec-w-2025-1832

Vulnerability from csaf_certbund

Tags

Sightings

Nomenclature