Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-1258

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.

Published

2018-05-11T20:29:00.260

Last Modified

2024-11-21T03:59:28.953

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.8 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: SINGLE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

8.0

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-863
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application pivotal_software spring_security * Yes
Application vmware spring_framework 5.0.5 Yes
Application oracle agile_plm 9.3.3 Yes
Application oracle agile_plm 9.3.4 Yes
Application oracle agile_plm 9.3.5 Yes
Application oracle agile_plm 9.3.6 Yes
Application oracle application_testing_suite 10.1 Yes
Application oracle application_testing_suite 12.5.0.3 Yes
Application oracle application_testing_suite 13.1.0.1 Yes
Application oracle application_testing_suite 13.2.0.1 Yes
Application oracle application_testing_suite 13.3.0.1 Yes
Application oracle big_data_discovery 1.6.0 Yes
Application oracle communications_converged_application_server < 7.0.0.1 Yes
Application oracle communications_diameter_signaling_router < 8.3 Yes
Application oracle communications_network_integrity ≤ 7.3.6 Yes
Application oracle communications_performance_intelligence_center < 10.2.1 Yes
Application oracle communications_services_gatekeeper < 6.1.0.4.0 Yes
Application oracle endeca_information_discovery_integrator 3.1.0 Yes
Application oracle endeca_information_discovery_integrator 3.2.0 Yes
Application oracle enterprise_manager_for_mysql_database 13.2 Yes
Application oracle enterprise_manager_ops_center 12.2.2 Yes
Application oracle enterprise_manager_ops_center 12.3.3 Yes
Application oracle enterprise_repository 11.1.1.7.0 Yes
Application oracle enterprise_repository 12.1.3.0.0 Yes
Application oracle goldengate_for_big_data 12.2.0.1 Yes
Application oracle goldengate_for_big_data 12.3.1.1 Yes
Application oracle goldengate_for_big_data 12.3.2.1 Yes
Application oracle health_sciences_information_manager 3.0 Yes
Application oracle healthcare_master_person_index 3.0 Yes
Application oracle healthcare_master_person_index 4.0 Yes
Application oracle hospitality_guest_access 4.2.0 Yes
Application oracle hospitality_guest_access 4.2.1 Yes
Application oracle insurance_calculation_engine 10.1.1 Yes
Application oracle insurance_calculation_engine 10.2 Yes
Application oracle insurance_calculation_engine 10.2.1 Yes
Application oracle insurance_policy_administration 10.0 Yes
Application oracle insurance_policy_administration 10.1 Yes
Application oracle insurance_policy_administration 10.2 Yes
Application oracle insurance_policy_administration 11.0 Yes
Application oracle insurance_rules_palette 10.0 Yes
Application oracle insurance_rules_palette 10.1 Yes
Application oracle insurance_rules_palette 10.2 Yes
Application oracle insurance_rules_palette 11.0 Yes
Application oracle insurance_rules_palette 11.1 Yes
Application oracle micros_lucas 2.9.5 Yes
Application oracle mysql_enterprise_monitor ≤ 8.0.2.8191 Yes
Application oracle peoplesoft_enterprise_fin_install 9.2 Yes
Application oracle retail_assortment_planning 14.1 Yes
Application oracle retail_assortment_planning 15.0 Yes
Application oracle retail_assortment_planning 16.0 Yes
Application oracle retail_back_office 14.0 Yes
Application oracle retail_back_office 14.1 Yes
Application oracle retail_central_office 14.0 Yes
Application oracle retail_central_office 14.1 Yes
Application oracle retail_customer_insights 15.0 Yes
Application oracle retail_customer_insights 16.0 Yes
Application oracle retail_financial_integration 13.2 Yes
Application oracle retail_financial_integration 14.0 Yes
Application oracle retail_financial_integration 14.1 Yes
Application oracle retail_financial_integration 15.0 Yes
Application oracle retail_financial_integration 16.0 Yes
Application oracle retail_integration_bus 14.1.2 Yes
Application oracle retail_point-of-service 14.0 Yes
Application oracle retail_point-of-service 14.1 Yes
Application oracle retail_returns_management 14.0 Yes
Application oracle retail_returns_management 14.1 Yes
Application oracle retail_xstore_point_of_service 17.0 Yes
Application oracle service_architecture_leveraging_tuxedo 12.1.3.0.0 Yes
Application oracle service_architecture_leveraging_tuxedo 12.2.2.0.0 Yes
Application oracle tape_library_acsls 8.4 Yes
Application oracle weblogic_server 10.3.6.0 Yes
Application oracle weblogic_server 12.1.3.0 Yes
Application oracle weblogic_server 12.2.1.2 Yes
Application oracle weblogic_server 12.2.1.3 Yes
Application netapp oncommand_insight - Yes
Application netapp oncommand_unified_manager ≥ 7.3 Yes
Application netapp oncommand_unified_manager ≥ 9.4 Yes
Application netapp oncommand_workflow_automation - Yes
Application netapp snapcenter - Yes
Application netapp storage_automation_store - Yes
Application redhat fuse 7.3.0 Yes
References