CVE-2018-1257
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Exploitability: 2.8 / Impact: 3.6
Source: NVD
Description
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.
Affected (71)
Products: Vmware: Spring Framework · Redhat: Openshift · Oracle: Agile Product Lifecycle Management, Application Testing Suite, Big Data Discovery, Communications Converged Application Server, Communications Diameter Signaling Router, Communications Performance Intelligence Center, Communications Services Gatekeeper, Communications Unified Inventory Management, Endeca Information Discovery Integrator, Enterprise Manager Base Platform, Enterprise Manager For Mysql Database, Enterprise Manager Ops Center, Flexcube Private Banking, Goldengate For Big Data, Health Sciences Information Manager, Healthcare Master Person Index, Hospitality Guest Access, Insurance Calculation Engine, Insurance Rules Palette, Primavera Gateway, Retail Customer Insights, Retail Open Commerce Platform, Retail Order Broker, Retail Predictive Application Server, Service Architecture Leveraging Tuxedo, Tape Library Acsls, Utilities Network Management System, Weblogic Server
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Before 4.3.17 |
Configuration C
| Vulnerable Software | Affected Versions |
|---|---|
| Version 9.3.3 | |
| Version 12.5.0.3 | |
| Version 1.6.0 | |
| Before 7.0.0.1 | |
| Before 8.3 | |
| Before 10.2.1 | |
| Before 6.1.0.4.0 | |
| Version 7.3.2 | |
| Version 3.1.0 | |
| Version 12.1.0.5.0 | |
| Version 13.2 | |
| Version 12.3.3 | |
| Version 12.0.1.0 | |
| Version 12.2.0.1 | |
| Version 3.0 | |
| Version 3.0 | |
| Version 4.2.0 | |
| Version 10.1.1 | |
| Version 10.0 | |
| Version 15.2 | |
| Version 15.0 | |
| Version 5.3.0 | |
| Version 15.0 | |
| Version 14.0 | |
| Version 12.1.3.0.0 | |
| Version 8.4 | |
| Version 1.12.0.3 | |
| Version 10.3.6.0.0 |
References (22)
Source: security_alert@emc.com
PatchThird Party Advisory
Source: security_alert@emc.com
PatchThird Party Advisory
Source: security_alert@emc.com
PatchThird Party Advisory
Source: security_alert@emc.com
PatchThird Party Advisory
Source: security_alert@emc.com
PatchThird Party Advisory
Source: security_alert@emc.com
PatchThird Party Advisory
Source: security_alert@emc.com
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Timeline
No history available yet.