CVE-2018-1258

HIGH

8.8

Description

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.

CVE Details

CVSS v3.1 Score8.8

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredLOW

User InteractionNONE

Published5/11/2018

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

netapp:oncommand_insightnetapp:oncommand_unified_managernetapp:oncommand_workflow_automationnetapp:snapcenternetapp:storage_automation_storeoracle:agile_plmoracle:application_testing_suiteoracle:big_data_discoveryoracle:communications_converged_application_serveroracle:communications_diameter_signaling_routeroracle:communications_network_integrityoracle:communications_performance_intelligence_centeroracle:communications_services_gatekeeperoracle:endeca_information_discovery_integratororacle:enterprise_manager_for_mysql_databaseoracle:enterprise_manager_ops_centeroracle:enterprise_repositoryoracle:goldengate_for_big_dataoracle:health_sciences_information_manageroracle:healthcare_master_person_indexoracle:hospitality_guest_accessoracle:insurance_calculation_engineoracle:insurance_policy_administrationoracle:insurance_rules_paletteoracle:micros_lucasoracle:mysql_enterprise_monitororacle:peoplesoft_enterprise_fin_installoracle:retail_assortment_planningoracle:retail_back_officeoracle:retail_central_officeoracle:retail_customer_insightsoracle:retail_financial_integrationoracle:retail_integration_busoracle:retail_point-of-serviceoracle:retail_returns_managementoracle:retail_xstore_point_of_serviceoracle:service_architecture_leveraging_tuxedooracle:tape_library_acslsoracle:weblogic_serverpivotal_software:spring_securityredhat:fusevmware:spring_framework

Weaknesses (CWE)

CWE-863

References

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html(security_alert@emc.com)

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html(security_alert@emc.com)

http://www.securityfocus.com/bid/104222(security_alert@emc.com)

http://www.securitytracker.com/id/1041888(security_alert@emc.com)

http://www.securitytracker.com/id/1041896(security_alert@emc.com)

https://access.redhat.com/errata/RHSA-2019:2413(security_alert@emc.com)

https://pivotal.io/security/cve-2018-1258(security_alert@emc.com)

https://security.netapp.com/advisory/ntap-20181018-0002/(security_alert@emc.com)

https://www.oracle.com/security-alerts/cpuapr2020.html(security_alert@emc.com)

https://www.oracle.com/security-alerts/cpujan2020.html(security_alert@emc.com)

https://www.oracle.com/security-alerts/cpujan2021.html(security_alert@emc.com)

https://www.oracle.com/security-alerts/cpujul2020.html(security_alert@emc.com)

https://www.oracle.com/security-alerts/cpuoct2021.html(security_alert@emc.com)

https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html(security_alert@emc.com)

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html(security_alert@emc.com)

https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html(security_alert@emc.com)

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html(af854a3a-2127-422b-91ae-364da2661108)

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html(af854a3a-2127-422b-91ae-364da2661108)

http://www.securityfocus.com/bid/104222(af854a3a-2127-422b-91ae-364da2661108)

http://www.securitytracker.com/id/1041888(af854a3a-2127-422b-91ae-364da2661108)

http://www.securitytracker.com/id/1041896(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2019:2413(af854a3a-2127-422b-91ae-364da2661108)

https://pivotal.io/security/cve-2018-1258(af854a3a-2127-422b-91ae-364da2661108)

https://security.netapp.com/advisory/ntap-20181018-0002/(af854a3a-2127-422b-91ae-364da2661108)

https://www.oracle.com/security-alerts/cpuapr2020.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.oracle.com/security-alerts/cpujan2020.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.oracle.com/security-alerts/cpujan2021.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.oracle.com/security-alerts/cpujul2020.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.oracle.com/security-alerts/cpuoct2021.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.