Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack. This CVE addresses the partial fix for CVE-2018-1270 in the 4.3.x branch of the Spring Framework.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported
    versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP
    broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the
    broker that can lead to a remote code execution attack. This CVE addresses the partial fix for
    CVE-2018-1270 in the 4.3.x branch of the Spring Framework. (CVE-2018-1275)

The version of Oracle GoldenGate for Big Data application located on the remote host is 12.2.0.1.x less than 12.2.0.1.10 or 12.3.1.1.x less than 12.3.1.1.6. It is, therefore, affected by multiple vulnerabilities : 

  - An unspecified vulnerability exists in Oracle GoldenGate for Big Data.  An authenticated, remote attacker     can exploit this, via unknown vectors, to compromise confidentiality, integrity, and availability.
    (CVE-2016-0635)

  - An authorization bypass vulnerability exists in Spring Framework 5.0.5 when used in conjunction with     Spring Security and using method security. An authenticated, remote attacker can exploit this to gain     unauthorized access to methods that should be restricted. (CVE-2018-1258)

  - A remote code execution vulnerability exists in the Spring Framework. An unauthenticated, remote attacker     can exploit this to bypass authentication and execute arbitrary commands. (CVE-2018-1275)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Oracle Primavera Gateway installation running on the remote web server is 15.x prior to 15.2.15, 16.x prior to 16.2.8, or 17.x prior to 17.12.3. It is, therefore, affected by multiple vulnerabilities.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Application Testing Suite installed on the remote host is affected by multiple vulnerabilities : 

  - A remote code execution vulnerability exists in Apache Log4j 2.x     before 2.8.2 due to the ability to receive serialized log events     from another application. An unauthenticated, remote attacker can     exploit this, via a specially crafted message, to execute     arbitrary code on the remote host. (CVE-2017-5645)

  - A remote code execution vulnerability exists in Spring Framework     due to the exposure of STOMP over WebSocket endpoints with a     simple, in-memory STOMP broker through the spring-messaging     module. An unauthenticated, remote attacker can exploit this,     via a specially crafted message, to execute arbitrary code on the     remote host. (CVE-2018-1275)

The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities:

  - An unspecified vulnerability in the Spring Framework     (Sample Apps) subcomponent in Oracle WebLogic allows     an unauthenticated, remote attacker to takeover a     WebLogic server. (CVE-2018-1275)

  - An unspecified vulnerability in the WLS Core Components     subcomponent in Oracle WebLogic allows an     unauthenticated, remote attacker to takeover a     WebLogic server. (CVE-2018-2893)

  - An unspecified vulnerability in the WLS - Web Services     subcomponent in Oracle WebLogic allows an     unauthenticated, remote attacker with HTTP access to     compromise and takeover a WebLogic server.
    (CVE-2018-2894)

In addition, Oracle WebLogic Server is affected by several other lower scoring vulnerabilities in the WLS Core Components, JSF, SAML, and Console (jackson-databind) subcomponents.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
422625	SCA: security update for org.springframework:spring-messaging (GHSA-3rmv-2pg5-xvqj)	Tenable Cloud Security	SCA Checks	critical
422625	SCA: security update for org.springframework:spring-messaging (GHSA-3rmv-2pg5-xvqj)	Tenable Self-Hosted Container Security	SCA Checks	critical
134225	Oracle GoldenGate for Big Data 12.2.0.1.x < 12.2.0.1.10 / 12.3.1.1.x < 12.3.1.1.6 Multiple Vulnerabilities (Oct 2018 CPU)	Nessus	Misc.	critical
118714	Oracle Primavera Gateway Multiple Vulnerabilities (Oct 2018 CPU)	Nessus	CGI abuses	critical
111210	Oracle Application Testing Suite Multiple Vulnerabilities (April / July 2018 CPU)	Nessus	Misc.	critical
111209	Oracle WebLogic Server Multiple Vulnerabilities (July 2018 CPU)	Nessus	Misc.	critical

Detections

Analytics

CVE-2018-1275

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical