Request for exception approval for CVE-2024-38819 [Spring Framework Path Traversal Vulnerability

Description
We are facing a Path Traversal Vulnerability (CVE-2024-38819) in our application due to the Spring Framework.

Environment Details
• Spring Version: [Current Spring version] --> spring-boot-starter-web - 1.5.2.RELEASE
• Java Version: [Java 8]
• Dependency Management Tool: Maven
• Application Context: Spring boot web application
• Server: Tomcat

What We Tried
• Upgrading the Spring Web Version: Attempted upgrading the version of Spring Web dependency from 4.3.7.RELEASE.jar to 4.3.30.RELEASE.jar to resolve the issue. However, the vulnerability persists.

org.springframework spring-web 4.3.30.RELEASE or 4.3.x version with security fixes

• Higher Version of Spring Framework: Tried considering a higher version of Spring Framework, but it requires upgrading our Java version [Java 18], which is not feasible due to compatibility and operational constraints.

Request
• Is there a workaround or alternative solution to address this vulnerability without upgrading the Java version?
• If not, can an exception be made to skip this issue or any mitigations that can be applied at the code or configuration level? we would appreciate it if you could provide the confirmation in one of the following formats: 1. Vendor confirmation email2. Ticket updates in PDF format. 3. Confirmation published on the vendor website

Impact
This vulnerability poses a security risk to our application in production, and we are looking for a solution that doesn't disrupt our existing setup.

Reference Document: Spring Framework Path Traversal Vulnerability - CVE-2024-38819.docx

No repository file, test, or code entry point is named. Start by reviewing the reported spring-web versions, Java compatibility constraints, and the attached Spring Framework Path Traversal Vulnerability document; done would require a maintainer-confirmed remediation or exception decision.