PulseLinuxLINUX UPDATE INTELLIGENCE
CVE Database›Document archive›CVE-2016-9879

CVE-2016-9879

Security: Improper handling of path parameters allows bypassing the security constraint

Loading…

Severity

Moderate

Red Hat Product Security

6.5

CVSS 3.0

Review impact separately from score.

Published · December 28, 2016

Updated · May 15, 2026

Description

It was found that Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded / to a request an attacker may be able to bypass a security constraint.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

Use a Servlet container known not to include path parameters in the return values for getServletPath() and getPathInfo()

CVSS / CWE

CVSS 3.0 · 6.5
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CWE-20 · Improper Input Validation