When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is started. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); PID file / symlink behavior (`ApplicationPidFileWriter`). Versions that are no longer supported are also affected per vendor advisory.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.7.33CPE matchmatch criteria | cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:* | ||
>= 3.3.0, < 3.3.19CPE matchmatch criteria | cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:* | ||
>= 3.4.0, < 3.4.16CPE matchmatch criteria | cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:* | ||
>= 3.5.0, < 3.5.14CPE matchmatch criteria | cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:* | ||
>= 4.0.0, < 4.0.6CPE matchmatch criteria | cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.