PT-2026-82402
CVE-2026-47884
·
تاريخ النشر
2026-08-27
·
تاريخ التحديث
2026-10-08
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Spring Framework versions 7.0.0 through 7.0.8
Spring Framework versions 6.2.0 through 6.2.19
Spring Framework versions 6.1.0 through 6.1.28
Spring Framework versions 6.0.0 through 6.0.30
Spring Framework versions 5.3.0 through 5.3.49
Spring Framework versions prior to 5.2.25.RELEASE
Description
Use of
XsltView in a Spring MVC application can lead to Server-Side Request Forgery (SSRF) and Remote Code Execution (RCE) if the application implements an /** mapping that triggers view rendering without an explicitly specified view name.Recommendations
Update to a version newer than 7.0.8
Update to a version newer than 6.2.19
Update to a version newer than 6.1.28
Update to a version newer than 6.0.30
Update to a version newer than 5.3.49
Update to a version newer than 5.2.25.RELEASE
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾