Critical severity · published Apr 6, 2018
CVE-2018-1270
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a…
9.8
CVSS
77.5%
EPSS
No
On KEV
Description
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)77.5% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SF
Spring Framework · Spring by Pivotal
Versions prior to 5.0.5 and 4.3.15 · source: vendor, NVD
AT
Application Testing Suite · Oracle
12.5.0.3; 13.1.0.1; 13.2.0.1; 13.3.0.1 · source: NVD
BD
Big Data Discovery · Oracle
1.6.0 · source: NVD
CC
Communications Converged Application Server · Oracle
before 7.0.0.1 · source: NVD
CD
Communications Diameter Signaling Router · Oracle
before 8.3 · source: NVD
CP
Communications Performance Intelligence Center · Oracle
before 10.2.1 · source: NVD
CS
Communications Services Gatekeeper · Oracle
before 6.1.0.4.0 · source: NVD
DL
Debian Linux · Debian
9.0 · source: NVD
EM
Enterprise Manager Ops Center · Oracle
12.2.2; 12.3.3 · source: NVD
FU
Fuse · Redhat
1.0.0 · source: NVD
GF
Goldengate For Big Data · Oracle
12.2.0.1; 12.3.1.1; 12.3.2.1 · source: NVD
HS
Health Sciences Information Manager · Oracle
3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1270
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1270
Patch
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
Patch
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
Third Party Advisory
http://www.securityfocus.com/bid/103696
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2939
lists.apache.org
https://lists.apache.org/thread.html/4ed49b103f64a0cecb38064f26cbf1389afc12124653da2d35166dbe%40%3Cissues.activemq.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1%40%3Cissues.activemq.apache.org%3E
More from Spring Framework
9.8
CVE-2018-1273
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of…