CVE-2018-1272 Possible privilege escalation in org.springframework:spring-core
HighCVSS 7.5
EPSS 3.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.springframework/spring-core(Maven) | < 4.3.15 | 4.3.15 |
| org.springframework/spring-core(Maven) | = 1.0 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.0-rc1 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.0.1 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.1 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.1-rc1 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.1-rc2 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.1.1 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.1.2 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.1.3 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.1.4 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.1.5 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.2 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.2-rc1 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.2-rc2 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.2.1 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.2.2 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.2.3 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.2.4 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.2.5 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.2.6 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.2.7 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.2.8 | No fix listed |
| org.springframework/spring-core(Maven) | = 1.2.9 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0 | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.springframework/spring-core(Maven) | = 2.0-m1 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0-m2 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0-m3 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0-m4 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0-m5 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0-rc1 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0-rc2 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0.1 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0.2 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0.3 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0.4 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0.5 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0.6 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0.7 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.0.8 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.5 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.5.1 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.5.2 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.5.3 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.5.4 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.5.5 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.5.6 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.5.6.SEC01 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.5.6.SEC02 | No fix listed |
| org.springframework/spring-core(Maven) | = 2.5.6.SEC03 | No fix listed |
| org.springframework/spring-core(Maven) | = 3.0.0.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.0.1.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.0.2.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.0.3.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.0.4.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.0.5.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.0.6.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.0.7.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.1.0.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.1.1.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.1.2.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.1.3.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.1.4.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.0.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.1.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.10.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.11.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.12.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.13.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.14.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.15.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.16.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.17.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.18.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.2.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.3.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.4.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.5.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.6.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.7.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.8.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 3.2.9.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.0.0.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.0.1.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.0.2.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.0.3.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.0.4.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.0.5.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.0.6.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.0.7.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.0.8.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.0.9.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.1.0.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.1.1.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.1.2.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.1.3.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.1.4.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.1.5.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.1.6.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.1.7.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.1.8.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.1.9.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.2.0.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.2.1.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.2.2.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.2.3.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.2.4.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.2.5.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.2.6.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.2.7.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.2.8.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.2.9.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.0.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.1.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.10.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.11.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.12.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.13.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.14.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.2.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.3.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.4.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.5.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.6.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.7.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.8.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 4.3.9.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | >= 5.0.0, < 5.0.5 | 5.0.5 |
| org.springframework/spring-core(Maven) | = 5.0.0.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 5.0.1.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 5.0.2.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 5.0.3.RELEASE | No fix listed |
| org.springframework/spring-core(Maven) | = 5.0.4.RELEASE | No fix listed |
| debian/libspring-java(Debian:12) | < 4.3.19-1 | 4.3.19-1 |
| debian/libspring-java(Debian:13) | < 4.3.19-1 | 4.3.19-1 |
| debian/libspring-java(Debian:14) | < 4.3.19-1 | 4.3.19-1 |
| VMware spring framework | >= 4.3.0, < 4.3.15 | 4.3.15 |
| VMware spring framework | >= 5.0, < 5.0.5 | 5.0.5 |
| oracle application testing suite | = 12.5.0.3 | No fix listed |
| oracle application testing suite | = 13.1.0.1 | No fix listed |
| oracle application testing suite | = 13.2.0.1 | No fix listed |
| oracle application testing suite | = 13.3.0.1 | No fix listed |
| oracle big data discovery | = 1.6.0 | No fix listed |
| oracle communications converged application server | < 7.0.0.1 | 7.0.0.1 |
| oracle communications diameter signaling router | < 8.3 | 8.3 |
| oracle communications performance intelligence center | < 10.2.1 | 10.2.1 |
| oracle communications services gatekeeper | < 6.1.0.4.0 | 6.1.0.4.0 |
| oracle enterprise manager ops center | = 12.2.2 | No fix listed |
| oracle enterprise manager ops center | = 12.3.3 | No fix listed |
| oracle goldengate for big data | = 12.2.0.1 | No fix listed |
| oracle goldengate for big data | = 12.3.1.1 | No fix listed |
| oracle goldengate for big data | = 12.3.2.1 | No fix listed |
| oracle health sciences information manager | = 3.0 | No fix listed |
| oracle healthcare master person index | = 3.0 | No fix listed |
| oracle healthcare master person index | = 4.0 | No fix listed |
| oracle insurance calculation engine | = 10.1.1 | No fix listed |
| oracle insurance calculation engine | = 10.2 | No fix listed |
| oracle insurance calculation engine | = 10.2.1 | No fix listed |
| oracle insurance rules palette | = 10.0 | No fix listed |
| oracle insurance rules palette | = 10.1 | No fix listed |
| oracle insurance rules palette | = 10.2 | No fix listed |
| oracle insurance rules palette | = 11.0 | No fix listed |
| oracle insurance rules palette | = 11.1 | No fix listed |
| oracle primavera gateway | = 15.2 | No fix listed |
| oracle primavera gateway | = 16.2 | No fix listed |
| oracle primavera gateway | = 17.12 | No fix listed |
| oracle retail back office | = 14.0 | No fix listed |
| oracle retail back office | = 14.1 | No fix listed |
| oracle retail central office | = 14.0 | No fix listed |
| oracle retail central office | = 14.1 | No fix listed |
| oracle retail customer insights | = 15.0 | No fix listed |
| oracle retail customer insights | = 16.0 | No fix listed |
| oracle retail integration bus | = 14.0.1 | No fix listed |
| oracle retail integration bus | = 14.0.2 | No fix listed |
| oracle retail integration bus | = 14.0.3 | No fix listed |
| oracle retail integration bus | = 14.0.4 | No fix listed |
| oracle retail integration bus | = 14.1.1 | No fix listed |
| oracle retail integration bus | = 14.1.2 | No fix listed |
| oracle retail integration bus | = 14.1.3 | No fix listed |
| oracle retail integration bus | = 15.0.0.1 | No fix listed |
| oracle retail integration bus | = 15.0.1 | No fix listed |
| oracle retail integration bus | = 15.0.2 | No fix listed |
| oracle retail integration bus | = 16.0 | No fix listed |
| oracle retail integration bus | = 16.0.1 | No fix listed |
| oracle retail integration bus | = 16.0.2 | No fix listed |
| oracle retail open commerce platform | = 5.3.0 | No fix listed |
| oracle retail open commerce platform | = 6.0.0 | No fix listed |
| oracle retail open commerce platform | = 6.0.1 | No fix listed |
| oracle retail order broker | = 5.1 | No fix listed |
| oracle retail order broker | = 5.2 | No fix listed |
| oracle retail order broker | = 15.0 | No fix listed |
| oracle retail order broker | = 16.0 | No fix listed |
| oracle retail point-of-sale | = 14.0 | No fix listed |
| oracle retail point-of-sale | = 14.1 | No fix listed |
| oracle retail predictive application server | = 14.0 | No fix listed |
| oracle retail predictive application server | = 14.1 | No fix listed |
| oracle retail predictive application server | = 15.0 | No fix listed |
| oracle retail predictive application server | = 16.0 | No fix listed |
| oracle retail returns management | = 14.0 | No fix listed |
| oracle retail returns management | = 14.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- RHSA-2018:1320 third-party-advisory vendor-advisory
- RHSA-2018:2669 third-party-advisory vendor-advisory
- github.com vendor-advisory
- pivotal.io vendor-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- 103697 third-party-advisory vdb-entry
- Debian Security Tracker CVE-2018-1272 vendor-advisory
- bugs.debian.org issue-tracking