From 769303189cc99245500978e1ce254bbba8b4f9df Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Thu, 19 Dec 2024 22:36:37 +0000
Subject: [PATCH] Publish Advisories

GHSA-g5vr-rgqm-vf78
GHSA-g5vr-rgqm-vf78
---
 .../GHSA-g5vr-rgqm-vf78.json                  | 92 +++++++++++++++++++
 .../GHSA-g5vr-rgqm-vf78.json                  | 36 --------
 2 files changed, 92 insertions(+), 36 deletions(-)
 create mode 100644 advisories/github-reviewed/2024/12/GHSA-g5vr-rgqm-vf78/GHSA-g5vr-rgqm-vf78.json
 delete mode 100644 advisories/unreviewed/2024/12/GHSA-g5vr-rgqm-vf78/GHSA-g5vr-rgqm-vf78.json

diff --git a/advisories/github-reviewed/2024/12/GHSA-g5vr-rgqm-vf78/GHSA-g5vr-rgqm-vf78.json b/advisories/github-reviewed/2024/12/GHSA-g5vr-rgqm-vf78/GHSA-g5vr-rgqm-vf78.json
new file mode 100644
index 00000000000..8f04ee04dad
--- /dev/null
+++ b/advisories/github-reviewed/2024/12/GHSA-g5vr-rgqm-vf78/GHSA-g5vr-rgqm-vf78.json
@@ -0,0 +1,92 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-g5vr-rgqm-vf78",
+  "modified": "2024-12-19T22:35:06Z",
+  "published": "2024-12-19T18:31:38Z",
+  "aliases": [
+    "CVE-2024-38819"
+  ],
+  "summary": "Spring Framework Path Traversal vulnerability",
+  "details": "Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.springframework:spring-webflux"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "6.1.14"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.springframework:spring-webmvc"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "6.1.14"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38819"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/spring-projects/spring-framework/issues/33689"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/spring-projects/spring-framework/commit/3bfbe30a7814c9ea1556d40df9bd87ddb3ba372d"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/spring-projects/spring-framework/commit/fb7890d73975a3d9e0763e0926df2bd0a608e87e"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/spring-projects/spring-framework"
+    },
+    {
+      "type": "WEB",
+      "url": "https://spring.io/security/cve-2024-38819"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-22"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-12-19T22:35:06Z",
+    "nvd_published_at": "2024-12-19T18:15:10Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/12/GHSA-g5vr-rgqm-vf78/GHSA-g5vr-rgqm-vf78.json b/advisories/unreviewed/2024/12/GHSA-g5vr-rgqm-vf78/GHSA-g5vr-rgqm-vf78.json
deleted file mode 100644
index 488d1688e9f..00000000000
--- a/advisories/unreviewed/2024/12/GHSA-g5vr-rgqm-vf78/GHSA-g5vr-rgqm-vf78.json
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-g5vr-rgqm-vf78",
-  "modified": "2024-12-19T18:31:38Z",
-  "published": "2024-12-19T18:31:38Z",
-  "aliases": [
-    "CVE-2024-38819"
-  ],
-  "details": "Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.",
-  "severity": [
-    {
-      "type": "CVSS_V3",
-      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
-    }
-  ],
-  "affected": [],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38819"
-    },
-    {
-      "type": "WEB",
-      "url": "https://spring.io/security/cve-2024-38819"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-      "CWE-22"
-    ],
-    "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2024-12-19T18:15:10Z"
-  }
-}
\ No newline at end of file