← Vulnerability feed

Vulnerability record · CVE-2014-3578 · published 19 February 2015

CVE-2014-3578: Pivotal software spring framework path traversal vulnerability

Pivotal Software · Spring Framework

Directory traversal vulnerability in Pivotal Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5 allows remote attackers to read arbitrary files via a crafted URL.

5.0 CVSS 2.0 Medium EPSS 6.3% · top 6.6% CWE-22 · Path traversal
5.0CVSS 2.0 base score
6.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
18References
17 Jun 2026Last modified by NVD

Description

Directory traversal vulnerability in Pivotal Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5 allows remote attackers to read arbitrary files via a crafted URL.

AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://jvn.jp/en/jp/JVN49154900/index.html Third Party AdvisoryVDB Entry
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000054 Third Party AdvisoryVDB Entry
http://pivotal.io/security/cve-2014-3578 Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-0720.html Third Party Advisory
http://www.securityfocus.com/bid/68042 Third Party AdvisoryVDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1131882 Issue TrackingThird Party Advisory
https://lists.debian.org/debian-lts-announce/2019/07/msg00012.html
https://rhn.redhat.com/errata/RHSA-2015-0234.html Third Party Advisory
https://rhn.redhat.com/errata/RHSA-2015-0235.html Third Party Advisory
http://jvn.jp/en/jp/JVN49154900/index.html Third Party AdvisoryVDB Entry
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000054 Third Party AdvisoryVDB Entry
http://pivotal.io/security/cve-2014-3578 Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-0720.html Third Party Advisory
http://www.securityfocus.com/bid/68042 Third Party AdvisoryVDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1131882 Issue TrackingThird Party Advisory
https://lists.debian.org/debian-lts-announce/2019/07/msg00012.html
https://rhn.redhat.com/errata/RHSA-2015-0234.html Third Party Advisory
https://rhn.redhat.com/errata/RHSA-2015-0235.html Third Party Advisory

Track CVE-2014-3578 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2014-0225Pivotal software spring framework xml external entity (xxe) vulnerabilityWhen processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not d…EPSS 1.7%7.5CVE-2016-5007Pivotal software spring framework permissions and access controls vulnerabilityBoth Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for m…EPSS 2.8%7.5CVE-2016-9878Pivotal software spring framework path traversal vulnerabilityAn issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. Paths provided to the ResourceServlet …EPSS 5.7%6.8CVE-2013-6429Spring MVC SourceHttpMessageConverter XXE enables file read and CSRFSpring MVC's SourceHttpMessageConverter in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 fails to disable external entity resolution w…EPSS 91%analysed5.5CVE-2015-3192Pivotal software spring framework memory buffer overflow vulnerabilityPivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which …EPSS 2.6%5.4CVE-2013-6430Pivotal software spring framework cross-site scripting vulnerabilityThe JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape …EPSS 1.8%5.0CVE-2015-0201Pivotal software spring framework vulnerabilityThe Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messag…EPSS 1.9%5.0CVE-2014-3625Pivotal software spring framework path traversal vulnerabilityDirectory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows re…EPSS 10%

Source: NIST National Vulnerability Database (record CVE-2014-3578), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.