Moderate severity vulnerability that affects com.sparkjava:spark-core · CVE-2018-9159 · GitHub Advisory Database · GitHub

Moderate severity vulnerability that affects com.sparkjava:spark-core

Moderate severity GitHub Reviewed Published Oct 19, 2018 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

com.sparkjava:spark-core (Maven)

Affected versions

< 2.7.2

Patched versions

2.7.2

Description

In Spark before 2.7.2, a remote attacker can read unintended static files via various representations of absolute or relative pathnames, as demonstrated by file: URLs and directory traversal sequences. NOTE: this product is unrelated to Ignite Realtime Spark.

References

Published to the GitHub Advisory Database Oct 19, 2018

Reviewed Jun 16, 2020

Last updated Jan 9, 2023

Severity

Moderate

5.3

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N