Spring by Pivotal Spring Framework
At a glance
- Source
- NVD
- EPSS
- EPSS 57.41 % · percentile 99 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- dell
- NVD status
- Modified
Description
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack. This CVE addresses the partial fix for CVE-2018-1270 in the 4.3.x branch of the Spring Framework.
Weaknesses (CWE)
- CWE-94 — Improper Control of Generation of Code
- CWE-358 — Improperly Implemented Security Check for Standard
References
- http://www.securitytracker.com/id/1041301
- https://access.redhat.com/errata/RHSA-2018:2939
- https://access.redhat.com/errata/RHSA-2018:1320
- http://www.securityfocus.com/bid/103771
- https://lists.apache.org/thread.html/4ed49b103f64a0cecb38064f26cbf1389afc12124653da2d35166dbe%40%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/ab825fcade0b49becfa30235b3d54f4a51bb74ea96b6c9adb5d1378c%40%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369%40%3Cissues.activemq.apache.org%3E
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://pivotal.io/security/cve-2018-1275
- https://www.oracle.com/security-alerts/cpuoct2021.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-3rmv-2pg5-xvqj — Spring Framework has Improperly Implemented Security Check for Standard
European references
- ENISA EUVD · EUVD-2018-0490
- GCVE · GCVE-0-2018-1275
CERT-FR advisories
- CERTFR-2019-AVI-023 — Multiples vulnérabilités dans Oracle Sun Systems · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*≥ 4.3.0 < 4.3.16cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*≥ 5.0.0 < 5.0.5cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:*:*:*:*:*:*:*cpe:2.3:a:oracle:application_testing_suite:13.1.0.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:application_testing_suite:13.2.0.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:big_data_discovery:1.6.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_converged_application_server:*:*:*:*:*:*:*:*< 7.0.0.1cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*< 8.3cpe:2.3:a:oracle:communications_performance_intelligence_center:*:*:*:*:*:*:*:*< 10.2.1cpe:2.3:a:oracle:communications_services_gatekeeper:*:*:*:*:*:*:*:*< 6.1.0.4.0cpe:2.3:a:oracle:goldengate_for_big_data:12.2.0.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:goldengate_for_big_data:12.3.1.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:goldengate_for_big_data:12.3.2.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:health_sciences_information_manager:3.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:healthcare_master_person_index:3.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:healthcare_master_person_index:4.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:insurance_calculation_engine:10.1.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:insurance_calculation_engine:10.2:*:*:*:*:*:*:*cpe:2.3:a:oracle:insurance_calculation_engine:10.2.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:insurance_rules_palette:10.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:insurance_rules_palette:10.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:insurance_rules_palette:10.2:*:*:*:*:*:*:*cpe:2.3:a:oracle:insurance_rules_palette:11.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:insurance_rules_palette:11.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:primavera_gateway:15.2:*:*:*:*:*:*:*cpe:2.3:a:oracle:primavera_gateway:16.2:*:*:*:*:*:*:*cpe:2.3:a:oracle:primavera_gateway:17.12:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_customer_insights:15.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_customer_insights:16.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_open_commerce_platform:5.3.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_open_commerce_platform:6.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_open_commerce_platform:6.0.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_order_broker:5.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_order_broker:5.2:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_order_broker:15.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_order_broker:16.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_predictive_application_server:14.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_predictive_application_server:14.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_predictive_application_server:15.0:*:*:*:*:*:*:*- +4 more
Affected products
| Product | Versions |
|---|---|
| Spring by Pivotal · Spring Framework | affected Versions prior to 5.0.5 and 4.3.16 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |