CVE-2014-3578

Directory traversal vulnerability in Pivotal Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5 allows remote attackers to read arbitrary files via a crafted URL.

• CWE-22

• http://jvn.jp/en/jp/JVN49154900/index.htmlThird Party Advisory, VDB Entry
• http://jvndb.jvn.jp/jvndb/JVNDB-2014-000054Third Party Advisory, VDB Entry
• http://pivotal.io/security/cve-2014-3578Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0720.htmlThird Party Advisory
• http://www.securityfocus.com/bid/68042Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=1131882Issue Tracking, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/07/msg00012.html
• https://rhn.redhat.com/errata/RHSA-2015-0234.htmlThird Party Advisory
• https://rhn.redhat.com/errata/RHSA-2015-0235.htmlThird Party Advisory
• http://jvn.jp/en/jp/JVN49154900/index.htmlThird Party Advisory, VDB Entry
• http://jvndb.jvn.jp/jvndb/JVNDB-2014-000054Third Party Advisory, VDB Entry
• http://pivotal.io/security/cve-2014-3578Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0720.htmlThird Party Advisory
• http://www.securityfocus.com/bid/68042Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=1131882Issue Tracking, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/07/msg00012.html
• https://rhn.redhat.com/errata/RHSA-2015-0234.htmlThird Party Advisory
• https://rhn.redhat.com/errata/RHSA-2015-0235.htmlThird Party Advisory

Published

Feb 19, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-3572The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL b…
• CVE-2014-3573The oVirt Engine backend module, as used in Red Hat Enterpri…
• CVE-2014-3574Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows…
• CVE-2014-3575The OLE preview generation in Apache OpenOffice before 4.1.1…
• CVE-2014-3576The processControlCommand function in broker/TransportConnec…
• CVE-2014-3577org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComp…
• CVE-2014-3579XML external entity (XXE) vulnerability in Apache ActiveMQ A…
• CVE-2014-3580The mod_dav_svn Apache HTTPD server module in Apache Subvers…
• CVE-2014-3581The cache_merge_headers_out function in modules/cache/cache_…
• CVE-2014-3582In Ambari 1.2.0 through 2.2.2, it may be possible to execute…
• CVE-2014-3583The handle_headers function in mod_proxy_fcgi.c in the mod_p…
• CVE-2014-3584The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x b…