CVE-2018-1258 Spring Framework when used in combination with any versions of Spring Security contains an authorization bypass
HighCVSS 8.8
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.springframework/spring-core(Maven) | >= 5.0.5.RELEASE, < 5.0.6.RELEASE | 5.0.6.RELEASE |
| org.springframework/spring-core(Maven) | = 5.0.5.RELEASE | No fix listed |
| pivotal Spring Framework | = 5.0.5 | No fix listed |
| pivotal software spring security | All versions | No fix listed |
| VMware spring framework | = 5.0.5 | No fix listed |
| oracle agile product lifecycle management | = 9.3.3 | No fix listed |
| oracle agile product lifecycle management | = 9.3.4 | No fix listed |
| oracle agile product lifecycle management | = 9.3.5 | No fix listed |
| oracle agile product lifecycle management | = 9.3.6 | No fix listed |
| oracle application testing suite | = 10.1 | No fix listed |
| oracle application testing suite | = 12.5.0.3 | No fix listed |
| oracle application testing suite | = 13.1.0.1 | No fix listed |
| oracle application testing suite | = 13.2.0.1 | No fix listed |
| oracle application testing suite | = 13.3.0.1 | No fix listed |
| oracle big data discovery | = 1.6.0 | No fix listed |
| oracle communications converged application server | < 7.0.0.1 | 7.0.0.1 |
| oracle communications diameter signaling router | < 8.3 | 8.3 |
| oracle communications network integrity | >= 7.3.2, <= 7.3.6 | No fix listed |
| oracle communications performance intelligence center | < 10.2.1 | 10.2.1 |
| oracle communications services gatekeeper | < 6.1.0.4.0 | 6.1.0.4.0 |
| oracle endeca information discovery integrator | = 3.1.0 | No fix listed |
| oracle endeca information discovery integrator | = 3.2.0 | No fix listed |
| oracle enterprise manager for mysql database | = 13.2 | No fix listed |
| oracle enterprise manager ops center | = 12.2.2 | No fix listed |
| oracle enterprise manager ops center | = 12.3.3 | No fix listed |
Show 59 more
| Product | Affected versions | Fixed in |
|---|---|---|
| oracle enterprise repository | = 11.1.1.7.0 | No fix listed |
| oracle enterprise repository | = 12.1.3.0.0 | No fix listed |
| oracle goldengate for big data | = 12.2.0.1 | No fix listed |
| oracle goldengate for big data | = 12.3.1.1 | No fix listed |
| oracle goldengate for big data | = 12.3.2.1 | No fix listed |
| oracle health sciences information manager | = 3.0 | No fix listed |
| oracle healthcare master person index | = 3.0 | No fix listed |
| oracle healthcare master person index | = 4.0 | No fix listed |
| oracle hospitality guest access | = 4.2.0 | No fix listed |
| oracle hospitality guest access | = 4.2.1 | No fix listed |
| oracle insurance calculation engine | = 10.1.1 | No fix listed |
| oracle insurance calculation engine | = 10.2 | No fix listed |
| oracle insurance calculation engine | = 10.2.1 | No fix listed |
| oracle insurance policy administration | = 10.0 | No fix listed |
| oracle insurance policy administration | = 10.1 | No fix listed |
| oracle insurance policy administration | = 10.2 | No fix listed |
| oracle insurance policy administration | = 11.0 | No fix listed |
| oracle insurance rules palette | = 10.0 | No fix listed |
| oracle insurance rules palette | = 10.1 | No fix listed |
| oracle insurance rules palette | = 10.2 | No fix listed |
| oracle insurance rules palette | = 11.0 | No fix listed |
| oracle insurance rules palette | = 11.1 | No fix listed |
| oracle micros lucas | = 2.9.5 | No fix listed |
| oracle mysql enterprise monitor | <= 8.0.2.8191 | No fix listed |
| oracle peoplesoft enterprise fin install | = 9.2 | No fix listed |
| oracle retail assortment planning | = 14.1 | No fix listed |
| oracle retail assortment planning | = 15.0 | No fix listed |
| oracle retail assortment planning | = 16.0 | No fix listed |
| oracle retail back office | = 14.0 | No fix listed |
| oracle retail back office | = 14.1 | No fix listed |
| oracle retail central office | = 14.0 | No fix listed |
| oracle retail central office | = 14.1 | No fix listed |
| oracle retail customer insights | = 15.0 | No fix listed |
| oracle retail customer insights | = 16.0 | No fix listed |
| oracle retail financial integration | = 13.2 | No fix listed |
| oracle retail financial integration | = 14.0 | No fix listed |
| oracle retail financial integration | = 14.1 | No fix listed |
| oracle retail financial integration | = 15.0 | No fix listed |
| oracle retail financial integration | = 16.0 | No fix listed |
| oracle retail integration bus | = 14.1.2 | No fix listed |
| oracle retail point-of-service | = 14.0 | No fix listed |
| oracle retail point-of-service | = 14.1 | No fix listed |
| oracle retail returns management | = 14.0 | No fix listed |
| oracle retail returns management | = 14.1 | No fix listed |
| oracle retail xstore point of service | = 17.0 | No fix listed |
| oracle service architecture leveraging tuxedo | = 12.1.3.0.0 | No fix listed |
| oracle service architecture leveraging tuxedo | = 12.2.2.0.0 | No fix listed |
| oracle tape library acsls | = 8.4 | No fix listed |
| oracle weblogic server | = 10.3.6.0 | No fix listed |
| oracle weblogic server | = 12.1.3.0 | No fix listed |
| oracle weblogic server | = 12.2.1.2 | No fix listed |
| oracle weblogic server | = 12.2.1.3 | No fix listed |
| netapp oncommand insight | All versions | No fix listed |
| netapp oncommand unified manager | >= 7.3 | No fix listed |
| netapp oncommand unified manager | >= 9.4 | No fix listed |
| netapp oncommand workflow automation | All versions | No fix listed |
| netapp snapcenter | All versions | No fix listed |
| netapp storage automation store | All versions | No fix listed |
| redhat fuse | = 7.3.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- web.archive.org
- web.archive.org
- web.archive.org
- security.netapp.com third-party-advisory
- pivotal.io vendor-advisory
- github.com product
- github.com vendor-advisory
- RHSA-2019:2413 patch third-party-advisory vendor-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- 104222 third-party-advisory vdb-entry
- 1041888 third-party-advisory vdb-entry
- 1041896 third-party-advisory vdb-entry