GHSA-cxrj-66c5-9fmh
Spring Framework when used in combination with any versions of Spring Security contains an authorization bypass
At a glance
- Published
- Updated
- CVE
- CVE-2018-1258
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.springframework:spring-core | introduced 5.0.5.RELEASE, fixed 5.0.6.RELEASE |
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-1258 ADVISORY
- https://github.com/spring-projects/spring-framework/commit/7b8fa90d96aaf751a3256fa755d5f17e081c20f1 WEB
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html WEB
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html WEB
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html WEB
- https://www.oracle.com/security-alerts/cpuoct2021.html WEB
- https://www.oracle.com/security-alerts/cpujul2020.html WEB
- https://www.oracle.com/security-alerts/cpujan2021.html WEB
- https://www.oracle.com/security-alerts/cpujan2020.html WEB
- https://www.oracle.com/security-alerts/cpuapr2020.html WEB
- https://web.archive.org/web/20200807033751/http://www.securitytracker.com/id/1041896 WEB
- https://web.archive.org/web/20200807025819/http://www.securitytracker.com/id/1041888 WEB
- https://web.archive.org/web/20200227032934/http://www.securityfocus.com/bid/104222 WEB
- https://security.netapp.com/advisory/ntap-20181018-0002 WEB
- https://pivotal.io/security/cve-2018-1258 WEB
- https://github.com/spring-projects/spring-framework PACKAGE
- https://github.com/advisories/GHSA-cxrj-66c5-9fmh ADVISORY
- https://access.redhat.com/errata/RHSA-2019:2413 WEB
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html WEB
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |