Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-1271

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.

Published

2018-04-06T13:29:00.500

Last Modified

2024-11-21T03:59:30.683

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.9 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

8.6

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-22
  • Type: Secondary
    CWE-22
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application vmware spring_framework < 4.3.15 Yes
Application vmware spring_framework < 5.0.5 Yes
Application oracle application_testing_suite 12.5.0.3 Yes
Application oracle application_testing_suite 13.1.0.1 Yes
Application oracle application_testing_suite 13.2.0.1 Yes
Application oracle application_testing_suite 13.3.0.1 Yes
Application oracle big_data_discovery 1.6.0 Yes
Application oracle communications_converged_application_server < 7.0.0.1 Yes
Application oracle communications_diameter_signaling_router < 8.3 Yes
Application oracle communications_performance_intelligence_center < 10.2.1 Yes
Application oracle communications_policy_management 12.5.0 Yes
Application oracle communications_services_gatekeeper < 6.1.0.4.0 Yes
Application oracle enterprise_manager_ops_center 12.2.2 Yes
Application oracle enterprise_manager_ops_center 12.3.3 Yes
Application oracle goldengate_for_big_data 12.2.0.1 Yes
Application oracle goldengate_for_big_data 12.3.1.1 Yes
Application oracle goldengate_for_big_data 12.3.2.1 Yes
Application oracle health_sciences_information_manager 3.0 Yes
Application oracle healthcare_master_person_index 3.0 Yes
Application oracle healthcare_master_person_index 4.0 Yes
Application oracle insurance_calculation_engine ≤ 11.3.1 Yes
Application oracle insurance_calculation_engine 10.1.1 Yes
Application oracle insurance_calculation_engine 10.2 Yes
Application oracle insurance_calculation_engine 10.2.1 Yes
Application oracle insurance_rules_palette 10.0 Yes
Application oracle insurance_rules_palette 10.1 Yes
Application oracle insurance_rules_palette 10.2 Yes
Application oracle insurance_rules_palette 11.0 Yes
Application oracle insurance_rules_palette 11.1 Yes
Application oracle primavera_gateway 15.2 Yes
Application oracle primavera_gateway 16.2 Yes
Application oracle primavera_gateway 17.12 Yes
Application oracle rapid_planning 12.1 Yes
Application oracle rapid_planning 12.2 Yes
Application oracle retail_back_office 14.0 Yes
Application oracle retail_back_office 14.1 Yes
Application oracle retail_central_office 14.0 Yes
Application oracle retail_central_office 14.1 Yes
Application oracle retail_customer_insights 15.0 Yes
Application oracle retail_customer_insights 16.0 Yes
Application oracle retail_integration_bus 14.0.1 Yes
Application oracle retail_integration_bus 14.0.2 Yes
Application oracle retail_integration_bus 14.0.3 Yes
Application oracle retail_integration_bus 14.0.4 Yes
Application oracle retail_integration_bus 14.1.1 Yes
Application oracle retail_integration_bus 14.1.2 Yes
Application oracle retail_integration_bus 14.1.3 Yes
Application oracle retail_integration_bus 15.0.0.1 Yes
Application oracle retail_integration_bus 15.0.1 Yes
Application oracle retail_integration_bus 15.0.2 Yes
Application oracle retail_integration_bus 16.0 Yes
Application oracle retail_integration_bus 16.0.1 Yes
Application oracle retail_integration_bus 16.0.2 Yes
Application oracle retail_open_commerce_platform 5.3.0 Yes
Application oracle retail_open_commerce_platform 6.0.0 Yes
Application oracle retail_open_commerce_platform 6.0.1 Yes
Application oracle retail_order_broker 5.1 Yes
Application oracle retail_order_broker 5.2 Yes
Application oracle retail_order_broker 15.0 Yes
Application oracle retail_order_broker 16.0 Yes
Application oracle retail_point-of-sale 14.0 Yes
Application oracle retail_point-of-sale 14.1 Yes
Application oracle retail_predictive_application_server 14.0 Yes
Application oracle retail_predictive_application_server 14.1 Yes
Application oracle retail_predictive_application_server 15.0 Yes
Application oracle retail_predictive_application_server 16.0 Yes
Application oracle retail_returns_management 14.0 Yes
Application oracle retail_returns_management 14.1 Yes
Application oracle retail_xstore_point_of_service 7.1 Yes
Application oracle service_architecture_leveraging_tuxedo 12.1.3.0.0 Yes
Application oracle service_architecture_leveraging_tuxedo 12.2.2.0.0 Yes
Application oracle tape_library_acsls 8.4 Yes
References