High severity · published May 11, 2018
CVE-2018-1258
Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security
8.8
CVSS
2.5%
EPSS
No
On KEV
Description
Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WS
WebLogic Server · Oracle
10.3.6.0; 12.1.3.0; 12.2.1.2; 12.2.1.3 · source: NVD
AP
Agile Product Lifecycle Management · Oracle
9.3.3; 9.3.4; 9.3.5; 9.3.6 · source: NVD
AT
Application Testing Suite · Oracle
10.1; 12.5.0.3; 13.1.0.1; 13.2.0.1; 13.3.0.1 · source: NVD
BD
Big Data Discovery · Oracle
1.6.0 · source: NVD
CC
Communications Converged Application Server · Oracle
before 7.0.0.1 · source: NVD
CD
Communications Diameter Signaling Router · Oracle
before 8.3 · source: NVD
CN
Communications Network Integrity · Oracle
7.3.2 through 7.3.6 · source: NVD
CP
Communications Performance Intelligence Center · Oracle
before 10.2.1 · source: NVD
CS
Communications Services Gatekeeper · Oracle
before 6.1.0.4.0 · source: NVD
EI
Endeca Information Discovery Integrator · Oracle
3.1.0; 3.2.0 · source: NVD
EM
Enterprise Manager For Mysql Database · Oracle
13.2 · source: NVD
EM
Enterprise Manager Ops Center · Oracle
12.2.2; 12.3.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1258
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1258
Patch
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
Patch
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
Third Party Advisory
http://www.securityfocus.com/bid/104222
Third Party Advisory
http://www.securitytracker.com/id/1041888
Third Party Advisory
http://www.securitytracker.com/id/1041896
Patch
https://access.redhat.com/errata/RHSA-2019:2413
More from WebLogic Server
9.8
CVE-2022-22965
Spring Framework JDK 9+ Remote Code Execution Vulnerability
9.8
CVE-2020-14750
Oracle WebLogic Server Remote Code Execution Vulnerability
9.8
CVE-2020-14882
Oracle WebLogic Server Remote Code Execution Vulnerability
9.8
CVE-2020-14644
Oracle WebLogic Server Remote Code Execution Vulnerability
9.8
CVE-2020-2883
Oracle WebLogic Server Unspecified Vulnerability