CVE-2015-5211

CRITICAL Year: 2015
CVSS v3 Score
9.6
Critical
CVSS v2 Score
9.3
Critical
Weakness Type
CWE-552
View all →

Vulnerability Description

Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being downloaded rather than rendered and also includes some input reflected in the response.

Related Vulnerabilities

CVE-2017-10930

CRITICAL
CVSS:9.8(Critical)

The ZXR10 1800-2S before v3.00.40 incorrectly restricts access to a resource from an unauthorized actor, resulting in ordinary users being able to download configuration files to steal information lik...

CWE-5522017

CVE-2017-14942

CRITICAL
CVSS:9.8(Critical)

Intelbras WRN 150 devices allow remote attackers to read the configuration file, and consequently bypass authentication, via a direct request for cgi-bin/DownloadCfg/RouterCfm.cfg containing an admin:...

CWE-5522017

CVE-2020-12743

CRITICAL
CVSS:9.8(Critical)

An issue was discovered in Gazie 7.32. A successful installation does not remove or block (or in any other way prevent use of) its own file /setup/install/setup.php, meaning that anyone can request it...

CWE-5522020

CVE-2023-29931

CRITICAL
CVSS:9.8(Critical)

laravel-s 3.7.35 is vulnerable to Local File Inclusion via /src/Illuminate/Laravel.php.

CWE-5522023

CVE-2023-48710

CRITICAL
CVSS:9.8(Critical)

iTop is an IT service management platform. Files from the `env-production` folder can be retrieved even though they should have restricted access. Hopefully, there is no sensitive files stored in that...

CWE-5522023

CVE-2023-50164

CRITICAL
CVSS:9.8(Critical)

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Use...

CWE-5522023