Spring Framework Path Traversal Vulnerability CVE-2024-38819

Products

• VMware Smart Assurance
• Network Observability

Issue/Introduction

User would like to know impact of CVE-2024-38819 in NCM.

Environment

NCM - 10.1.x/24.3.x

Resolution

According to NVD's CVE-2024-38819 and Spring KB Spring Security Advisories, an application is vulnerable when both of the following are true:

• The web application uses RouterFunctions to serve static resources
• Resource handling is explicitly configured with a FileSystemResource location

NCM does not use both hence NCM is not impacted of this vulnerability. 

NOTE: Spring is upgraded in 24.3.13 release hence upgrade to 24.3.13 to avail higher Spring version in NCM.