CVE-2018-1257

MEDIUM

6.5

Descricao

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.

Detalhes CVE

Pontuacao CVSS v3.16.5

SeveridadeMEDIUM

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosLOW

Interacao do usuarioNONE

Publicado5/11/2018

Ultima modificacao11/21/2024

Fontenvd

Avistamentos honeypot0

Produtos afetados

oracle:agile_product_lifecycle_managementoracle:application_testing_suiteoracle:big_data_discoveryoracle:communications_converged_application_serveroracle:communications_diameter_signaling_routeroracle:communications_performance_intelligence_centeroracle:communications_services_gatekeeperoracle:communications_unified_inventory_managementoracle:endeca_information_discovery_integratororacle:enterprise_manager_base_platformoracle:enterprise_manager_for_mysql_databaseoracle:enterprise_manager_ops_centeroracle:flexcube_private_bankingoracle:goldengate_for_big_dataoracle:health_sciences_information_manageroracle:healthcare_master_person_indexoracle:hospitality_guest_accessoracle:insurance_calculation_engineoracle:insurance_rules_paletteoracle:primavera_gatewayoracle:retail_customer_insightsoracle:retail_open_commerce_platformoracle:retail_order_brokeroracle:retail_predictive_application_serveroracle:service_architecture_leveraging_tuxedooracle:tape_library_acslsoracle:utilities_network_management_systemoracle:weblogic_serverredhat:openshiftvmware:spring_framework

Referencias

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html(security_alert@emc.com)

http://www.securityfocus.com/bid/104260(security_alert@emc.com)

https://access.redhat.com/errata/RHSA-2018:1809(security_alert@emc.com)

https://access.redhat.com/errata/RHSA-2018:3768(security_alert@emc.com)

https://pivotal.io/security/cve-2018-1257(security_alert@emc.com)

https://www.oracle.com/security-alerts/cpujan2020.html(security_alert@emc.com)

https://www.oracle.com/security-alerts/cpujul2020.html(security_alert@emc.com)

https://www.oracle.com/security-alerts/cpuoct2021.html(security_alert@emc.com)

https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html(security_alert@emc.com)

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html(security_alert@emc.com)

https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html(security_alert@emc.com)

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html(af854a3a-2127-422b-91ae-364da2661108)

http://www.securityfocus.com/bid/104260(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2018:1809(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2018:3768(af854a3a-2127-422b-91ae-364da2661108)

https://pivotal.io/security/cve-2018-1257(af854a3a-2127-422b-91ae-364da2661108)

https://www.oracle.com/security-alerts/cpujan2020.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.oracle.com/security-alerts/cpujul2020.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.oracle.com/security-alerts/cpuoct2021.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.