Medium severity · published Apr 6, 2018
CVE-2018-1271
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources…
5.9
CVSS
34.4%
EPSS
No
On KEV
Description
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)34.4% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AT
Application Testing Suite · Oracle
12.5.0.3; 13.1.0.1; 13.2.0.1; 13.3.0.1 · source: NVD
BD
Big Data Discovery · Oracle
1.6.0 · source: NVD
CC
Communications Converged Application Server · Oracle
before 7.0.0.1 · source: NVD
CD
Communications Diameter Signaling Router · Oracle
before 8.3 · source: NVD
CP
Communications Performance Intelligence Center · Oracle
before 10.2.1 · source: NVD
CP
Communications Policy Management · Oracle
12.5.0 · source: NVD
CS
Communications Services Gatekeeper · Oracle
before 6.1.0.4.0 · source: NVD
EM
Enterprise Manager Ops Center · Oracle
12.2.2; 12.3.3 · source: NVD
GF
Goldengate For Big Data · Oracle
12.2.0.1; 12.3.1.1; 12.3.2.1 · source: NVD
HS
Health Sciences Information Manager · Oracle
3.0 · source: NVD
HM
Healthcare Master Person Index · Oracle
3.0; 4.0 · source: NVD
IC
Insurance Calculation Engine · Oracle
11.0.0 through 11.3.1; 10.1.1; 10.2; 10.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1271
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1271
Patch
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
Patch
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
Third Party Advisory
http://www.securityfocus.com/bid/103699
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1320
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2669
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2939
More from Application Testing Suite
6.1
CVE-2020-11023
Potential XSS vulnerability in jQuery
9.8
CVE-2026-46924
Vulnerability in Oracle Application Testing Suite
9.8
CVE-2026-46876
Vulnerability in Oracle Application Testing Suite
9.8
CVE-2026-35290
Vulnerability in Oracle Application Testing Suite
9.8
CVE-2018-1285
Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files