CVE-2018-1258

MEDIUM

Description

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.

References

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

http://www.securityfocus.com/bid/104222

http://www.securitytracker.com/id/1041888

http://www.securitytracker.com/id/1041896

https://access.redhat.com/errata/RHSA-2019:2413

https://pivotal.io/security/cve-2018-1258

https://security.netapp.com/advisory/ntap-20181018-0002/

https://www.oracle.com/security-alerts/cpuapr2020.html

https://www.oracle.com/security-alerts/cpujan2020.html

https://www.oracle.com/security-alerts/cpujan2021.html

https://www.oracle.com/security-alerts/cpujul2020.html

https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html

https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Details

Source: MITRE

Published: 2018-05-11

Updated: 2021-01-20

Type: CWE-863

Risk Information

CVSS v2.0

Base Score: 6.5

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 8

Severity: MEDIUM

CVSS v3.0

Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Impact Score: 5.9

Exploitability Score: 2.8

Severity: HIGH

Vulnerable Software

Configuration 1

AND

cpe:2.3:a:pivotal_software:spring_framework:5.0.5:*:*:*:*:*:*:*

cpe:2.3:a:pivotal_software:spring_security:*:*:*:*:*:*:*:*

Configuration 2

OR

cpe:2.3:a:oracle:agile_plm:9.3.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:agile_plm:9.3.4:*:*:*:*:*:*:*

cpe:2.3:a:oracle:agile_plm:9.3.5:*:*:*:*:*:*:*

cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*

cpe:2.3:a:oracle:application_testing_suite:10.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:application_testing_suite:13.1.0.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:application_testing_suite:13.2.0.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:big_data_discovery:1.6.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_converged_application_server:*:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_performance_intelligence_center:*:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_services_gatekeeper:*:*:*:*:*:*:*:*

cpe:2.3:a:oracle:endeca_information_discovery_integrator:3.1.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:endeca_information_discovery_integrator:3.2.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:enterprise_manager_for_mysql_database:13.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:enterprise_repository:11.1.1.7.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:enterprise_repository:12.1.3.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:goldengate_for_big_data:12.2.0.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:goldengate_for_big_data:12.3.1.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:goldengate_for_big_data:12.3.2.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:health_sciences_information_manager:3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:healthcare_master_person_index:3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:healthcare_master_person_index:4.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:insurance_calculation_engine:10.1.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:insurance_calculation_engine:10.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:insurance_calculation_engine:10.2.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:insurance_policy_administration:10.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:insurance_policy_administration:10.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:insurance_policy_administration:10.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:insurance_policy_administration:11.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:insurance_rules_palette:10.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:insurance_rules_palette:10.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:insurance_rules_palette:10.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:insurance_rules_palette:11.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:insurance_rules_palette:11.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:micros_lucas:2.9.5:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* versions up to 8.0.2.8191 (inclusive)

cpe:2.3:a:oracle:peoplesoft_enterprise_fin_install:9.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_assortment_planning:14.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_assortment_planning:15.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_assortment_planning:16.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_central_office:14.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_central_office:14.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_customer_insights:15.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_customer_insights:16.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_financial_integration:13.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_financial_integration:14.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_financial_integration:14.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_financial_integration:15.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_financial_integration:16.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_integration_bus:14.1.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_point-of-service:14.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_point-of-service:14.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_returns_management:14.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:service_architecture_leveraging_tuxedo:12.1.3.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:service_architecture_leveraging_tuxedo:12.2.2.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:tape_library_acsls:8.4:*:*:*:*:*:*:*

cpe:2.3:a:oracle:weblogic_server:10.3.6.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:weblogic_server:12.1.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:weblogic_server:12.2.1.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:weblogic_server:12.2.1.3:*:*:*:*:*:*:*

Configuration 3

OR

cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:windows:*:*

cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:vsphere:*:*

cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:storage_automation_store:-:*:*:*:*:*:*:*

Tenable Plugins

View all (7 total)

IDNameProductFamilySeverity
138901MySQL Enterprise Monitor 3.4.x < 3.4.10 / 4.x < 4.0.7 / 8.x < 8.0.3 Multiple Vulnerabilities (Oct 2018 CPU)NessusCGI abuses
high
134225Oracle GoldenGate for Big Data 12.2.0.1.x < 12.2.0.1.10 / 12.3.1.1.x < 12.3.1.1.6 Multiple Vulnerabilities (Oct 2018 CPU)NessusMisc.
high
126775Oracle Enterprise Manager Cloud Control (Jul 2019 CPU)NessusMisc.
medium
125147Oracle Enterprise Manager Ops Center (Apr 2019 CPU)NessusMisc.
high
124157Oracle Enterprise Manager Cloud Control (Apr 2019 CPU)NessusMisc.
medium
124122Oracle WebLogic Server Multiple Vulnerabilities (Apr 2019 CPU)NessusMisc.
high
121257Oracle Application Testing Suite Multiple Vulnerabilities (Jan 2019 CPU)NessusMisc.
high