{"schemaVersion":3,"id":"CVE-2024-38816","aliases":["UBUNTU-CVE-2024-38816","DEBIAN-CVE-2024-38816","CGA-48ff-vvgg-c87j","CGA-67jh-j2m9-44j3","CGA-7vcx-rw92-vmx8","CGA-gm2f-6jj3-7xxh","CGA-jvwf-m73w-qpwp","CGA-mx2q-57c7-pgc3","CGA-p3vj-7jv6-755v","CGA-qf2r-ph72-3j54","CGA-qh6q-8ww9-cfjv","CGA-r62w-8437-r69v","CGA-2866-9mw4-p6gv","CGA-2fm9-q49p-gm5m","CGA-2vf3-h8r7-44gq","CGA-36p9-x74f-px4p","CGA-37hw-gwm6-q8q3","CGA-38v5-vg8q-x982","CGA-3f42-f5w9-g46q","CGA-3jw5-4wxc-f9x2","CGA-3mmj-w6x5-jpx5","CGA-3px6-3v89-2prh","CGA-5pwc-38h5-h23j","CGA-5q8v-c2mw-4fv7","CGA-6674-6rxh-9rg5","CGA-68g9-9f42-gpph","CGA-69qg-4fwj-f648","CGA-6cjq-86cc-pchm","CGA-6f4w-qm7h-hjhg","CGA-6p69-h9cw-q7gc","CGA-6rj5-74hc-wg6m","CGA-7ccv-42qp-4p3p","CGA-7fpv-jqww-cgxf","CGA-7g89-7f9q-x3p2","CGA-7jq9-6p65-qwp5","CGA-88gm-2xwf-vqx8","CGA-897f-j56m-69x8","CGA-8j87-58vm-5g7p","CGA-8v9w-4g7g-3fjp","CGA-976q-849w-8v2w","CGA-9889-m83f-rffg","CGA-f5wp-7x3c-739r","CGA-f6pm-vwrh-265p","CGA-f7r7-43jr-m996","CGA-fcv8-4v98-vwhv","CGA-ff93-v5ph-rr8r","CGA-fhh7-7vgq-q7pf","CGA-fpqm-h3r4-wr64","CGA-g727-jpcx-jvgg","CGA-g7hm-g7gm-62jh","CGA-h8qf-hhfj-75r8","CGA-hcqq-3mcp-7cj7","CGA-j5cm-4v7h-9gwh","CGA-jc54-4wpq-wjv9","CGA-jhq9-mrx4-5wm5","CGA-jhvg-r3fr-4ww4","CGA-m6pm-m2x3-pp67","CGA-m76p-whxh-c4p8","CGA-mgcr-wvrw-3ppx","CGA-mwq7-5x27-fmhf","CGA-pmcx-63v7-x862","GHSA-cx7f-g6mp-7hqm","CGA-q69w-29jw-52fp","CGA-qcm5-mv2j-f3wg","CGA-qf5j-7gmc-xj4q","CGA-qfjv-329q-3725","CGA-qv35-fp43-pf96","CGA-qxhx-9pfr-pxv7","CGA-v2f8-wq4m-gj53","CGA-v499-hgf8-7w7p","CGA-v7fp-g8pj-p76h","CGA-vh2m-6rp5-v3r5","CGA-vq8m-h582-577g","CGA-vq9v-8wcv-rr8p","CGA-w438-c37q-35hf","CGA-wcm6-7m55-pwqq","CGA-wvr3-xvm8-f44p","CGA-x8h6-3cwm-2wj8","CGA-x9cg-xx3p-5vvq","CGA-xfqv-5cr6-57q6","CGA-xhwh-mrg7-ch3q"],"status":"published","duplicateOf":null,"title":null,"description":"Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.\n\nSpecifically, an application is vulnerable when both of the following are true:\n\n  *  the web application uses RouterFunctions to serve static resources\n  *  resource handling is explicitly configured with a FileSystemResource location\n\n\nHowever, malicious requests are blocked and rejected when any of the following is true:\n\n  *  the  Spring Security HTTP Firewall https://docs.spring.io/spring-security/reference/servlet/exploits/firewall.html  is in use\n  *  the application runs on Tomcat or Jetty","dates":{"published":"2024-09-13T06:10:06.598Z","modified":"2025-03-18T15:06:29.551Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Maven","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.14718,"percentile":0.96646,"severity":"medium","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.14718},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.14718,"percentile":0.96646}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.14718,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.14718,"percentile":0.96646}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","description":"The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/22.html"}],"affected":[{"vendor":"chainguard","product":"apache-activemq-5.19","name":"apache-activemq-5.19","label":"apache-activemq-5.19","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apache-activemq-5.19","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"apache-activemq-fips-5.19","name":"apache-activemq-fips-5.19","label":"apache-activemq-fips-5.19","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apache-activemq-fips-5.19","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"geoserver-2.27","name":"geoserver-2.27","label":"geoserver-2.27","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/geoserver-2.27","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"geoserver-2.28","name":"geoserver-2.28","label":"geoserver-2.28","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/geoserver-2.28","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-2025.0","name":"kayenta-2025.0","label":"kayenta-2025.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-2025.0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-2025.1","name":"kayenta-2025.1","label":"kayenta-2025.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-2025.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-2025.2","name":"kayenta-2025.2","label":"kayenta-2025.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-2025.2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-2025.4","name":"kayenta-2025.4","label":"kayenta-2025.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-2025.4","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 2025.4.3-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 2025.4.3-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-2026.0","name":"kayenta-2026.0","label":"kayenta-2026.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-2026.0","purlType":"apk","versions":[{"text":"< 2026.0.2-r6","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"< 2026.0.2-r6 | All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-2026.1","name":"kayenta-2026.1","label":"kayenta-2026.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-2026.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-fips-2025.0","name":"kayenta-fips-2025.0","label":"kayenta-fips-2025.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-fips-2025.0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-fips-2025.1","name":"kayenta-fips-2025.1","label":"kayenta-fips-2025.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-fips-2025.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-fips-2025.2","name":"kayenta-fips-2025.2","label":"kayenta-fips-2025.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-fips-2025.2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-fips-2025.4","name":"kayenta-fips-2025.4","label":"kayenta-fips-2025.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-fips-2025.4","purlType":"apk","versions":[{"text":"< 2025.4.3-r7","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"< 2025.4.3-r7 | All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-fips-2026.0","name":"kayenta-fips-2026.0","label":"kayenta-fips-2026.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-fips-2026.0","purlType":"apk","versions":[{"text":"< 2026.0.2-r7","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"< 2026.0.2-r7 | All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-fips-2026.1","name":"kayenta-fips-2026.1","label":"kayenta-fips-2026.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-fips-2026.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ontop","name":"ontop","label":"ontop","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ontop","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ontop-fips","name":"ontop-fips","label":"ontop-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ontop-fips","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"thingsboard","name":"thingsboard","label":"thingsboard","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/thingsboard","purlType":"apk","versions":[{"text":"< 3.8.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.8.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"thingsboard-tb-js-executor","name":"thingsboard-tb-js-executor","label":"thingsboard-tb-js-executor","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/thingsboard-tb-js-executor","purlType":"apk","versions":[{"text":"< 3.8.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.8.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"thingsboard-tb-mqtt-transport","name":"thingsboard-tb-mqtt-transport","label":"thingsboard-tb-mqtt-transport","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/thingsboard-tb-mqtt-transport","purlType":"apk","versions":[{"text":"< 3.8.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.8.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"thingsboard-tb-node","name":"thingsboard-tb-node","label":"thingsboard-tb-node","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/thingsboard-tb-node","purlType":"apk","versions":[{"text":"< 3.8.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.8.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"thingsboard-tb-web-ui","name":"thingsboard-tb-web-ui","label":"thingsboard-tb-web-ui","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/thingsboard-tb-web-ui","purlType":"apk","versions":[{"text":"< 3.8.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.8.1-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"thingsboard","name":"thingsboard","label":"thingsboard","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/thingsboard","purlType":"apk","versions":[{"text":"< 3.8.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.8.1-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"thingsboard-tb-js-executor","name":"thingsboard-tb-js-executor","label":"thingsboard-tb-js-executor","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/thingsboard-tb-js-executor","purlType":"apk","versions":[{"text":"< 3.8.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.8.1-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"thingsboard-tb-mqtt-transport","name":"thingsboard-tb-mqtt-transport","label":"thingsboard-tb-mqtt-transport","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/thingsboard-tb-mqtt-transport","purlType":"apk","versions":[{"text":"< 3.8.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.8.1-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"thingsboard-tb-node","name":"thingsboard-tb-node","label":"thingsboard-tb-node","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/thingsboard-tb-node","purlType":"apk","versions":[{"text":"< 3.8.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.8.1-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"thingsboard-tb-web-ui","name":"thingsboard-tb-web-ui","label":"thingsboard-tb-web-ui","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/thingsboard-tb-web-ui","purlType":"apk","versions":[{"text":"< 3.8.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.8.1-r2","eol":null,"hubHref":null},{"vendor":"debian","product":"libspring-java","name":"libspring-java","label":"libspring-java","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/libspring-java","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"libspring-java","name":"libspring-java","label":"libspring-java","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/libspring-java","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"org.springframework","product":"spring-webflux","name":"org.springframework:spring-webflux","label":"spring-webflux","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.springframework/spring-webflux","purlType":"maven","versions":[{"text":"≥ 6.1.0, < 6.1.13","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.0.0, ≤ 6.0.23","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.3.0, ≤ 5.3.39","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 6.1.0, < 6.1.13 | ≥ 6.0.0, ≤ 6.0.23 | ≥ 5.3.0, ≤ 5.3.39","eol":null,"hubHref":null},{"vendor":"org.springframework","product":"spring-webmvc","name":"org.springframework:spring-webmvc","label":"spring-webmvc","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.springframework/spring-webmvc","purlType":"maven","versions":[{"text":"≥ 6.1.0, < 6.1.13","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.0.0, ≤ 6.0.23","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.3.0, ≤ 5.3.39","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 6.1.0, < 6.1.13 | ≥ 6.0.0, ≤ 6.0.23 | ≥ 5.3.0, ≤ 5.3.39","eol":{"isEol":null,"eolDate":null,"matchMethod":"purl","cycle":null,"product":{"name":"spring-framework","label":"Spring Framework","category":"framework"}},"hubHref":null},{"vendor":"spring","product":"spring","name":"Spring","label":"spring","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 5.3.x, < 5.3.40","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.0.x, < 6.0.24","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.1.x, < 6.1.13","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.3.x, < 5.3.40 | ≥ 6.0.x, < 6.0.24 | ≥ 6.1.x, < 6.1.13","eol":null,"hubHref":"/vendor/spring/spring"}],"affectedCount":33,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://spring.io/security/cve-2024-38816","label":"spring.io/security/cve-2024-38816","hostname":"spring.io","tags":["REPORT","WEB"]},{"url":"https://security.netapp.com/advisory/ntap-20241227-0001/","label":"security.netapp.com/advisory/ntap-20241227-0001/","hostname":"security.netapp.com","tags":[]},{"url":"https://ubuntu.com/security/CVE-2024-38816","label":"ubuntu.com/security/CVE-2024-38816","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-38816","label":"www.cve.org/CVERecord?id=CVE-2024-38816","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-38816","label":"security-tracker.debian.org/tracker/CVE-2024-38816","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38816","label":"nvd.nist.gov/vuln/detail/CVE-2024-38816","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/spring-projects/spring-framework/commit/d86bf8b2056429edf5494456cffcb2b243331c49","label":"github.com/spring-projects/spring-framework/commit/d86bf8b2056429edf5494456cffcb2b243331c49","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/spring-projects/spring-framework","label":"github.com/spring-projects/spring-framework","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://security.netapp.com/advisory/ntap-20241227-0001","label":"security.netapp.com/advisory/ntap-20241227-0001","hostname":"security.netapp.com","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-JFVW-F67X-XRRH"]},"timeline":[{"kind":"published","date":"2024-09-13T06:10:06.598Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-03-18T15:06:29.551Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":33,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T08:09:32.190Z","stale":false,"partial":false}}