Threats tagged 'ghsa-wwpq-f5c3-7hvx'

Spring Boot versions 2.7.0 through 2.7.32, 3.3.0 through 3.3.18, 3.4.0 through 3.4.15, 3.5.0 through 3.5.13, and 4.0.0 through 4.0.5 contain a vulnerability where the application accepts a predictable temporary directory without verifying ownership. This can allow a local attacker on the same host to take control of the directory used by ApplicationTemp. If server.servlet.session.persistent is enabled, the attacker may read session data, hijack authenticated users, or execute code as the application user. Fixed versions are available starting from 2.7.33, 3.3.19, 3.4.16, 3.5.14, and 4.0.6.