CVE-2018-1258

Published: May 11, 2018Modified: Nov 21, 2024

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.

Affected (81)

Products: Pivotal Software: Spring Security · Vmware: Spring Framework · Oracle: Agile Plm, Application Testing Suite, Big Data Discovery, Communications Converged Application Server, Communications Diameter Signaling Router, Communications Network Integrity, Communications Performance Intelligence Center, Communications Services Gatekeeper, Endeca Information Discovery Integrator, Enterprise Manager For Mysql Database, Enterprise Manager Ops Center, Enterprise Repository, Goldengate For Big Data, Health Sciences Information Manager, Healthcare Master Person Index, Hospitality Guest Access, Insurance Calculation Engine, Insurance Policy Administration, Insurance Rules Palette, Micros Lucas, Mysql Enterprise Monitor, Peoplesoft Enterprise Fin Install, Retail Assortment Planning, Retail Back Office, Retail Central Office, Retail Customer Insights, Retail Financial Integration, Retail Integration Bus, Retail Point Of Service, Retail Returns Management, Retail Xstore Point Of Service, Service Architecture Leveraging Tuxedo, Tape Library Acsls, Weblogic Server · +2 more

Show all products

Pivotal Software: Spring Security · Vmware: Spring Framework · Oracle: Agile Plm, Application Testing Suite, Big Data Discovery, Communications Converged Application Server, Communications Diameter Signaling Router, Communications Network Integrity, Communications Performance Intelligence Center, Communications Services Gatekeeper, Endeca Information Discovery Integrator, Enterprise Manager For Mysql Database, Enterprise Manager Ops Center, Enterprise Repository, Goldengate For Big Data, Health Sciences Information Manager, Healthcare Master Person Index, Hospitality Guest Access, Insurance Calculation Engine, Insurance Policy Administration, Insurance Rules Palette, Micros Lucas, Mysql Enterprise Monitor, Peoplesoft Enterprise Fin Install, Retail Assortment Planning, Retail Back Office, Retail Central Office, Retail Customer Insights, Retail Financial Integration, Retail Integration Bus, Retail Point Of Service, Retail Returns Management, Retail Xstore Point Of Service, Service Architecture Leveraging Tuxedo, Tape Library Acsls, Weblogic Server · Netapp: Oncommand Insight, Oncommand Unified Manager, Oncommand Workflow Automation, Snapcenter, Storage Automation Store · Redhat: Fuse

1 product

1 product

34 products

Application Testing Suite

Big Data Discovery

Communications Converged Application Server

Communications Diameter Signaling Router

Communications Network Integrity

Communications Performance Intelligence Center

Communications Services Gatekeeper

Endeca Information Discovery Integrator

Enterprise Manager For Mysql Database

Enterprise Manager Ops Center

Enterprise Repository

Goldengate For Big Data

Health Sciences Information Manager

Healthcare Master Person Index

Hospitality Guest Access

Insurance Calculation Engine

Insurance Policy Administration

Insurance Rules Palette

Micros Lucas

Mysql Enterprise Monitor

Peoplesoft Enterprise Fin Install

Retail Assortment Planning

Retail Back Office

Retail Central Office

Retail Customer Insights

Retail Financial Integration

Retail Integration Bus

Retail Point Of Service

Retail Returns Management

Retail Xstore Point Of Service

Service Architecture Leveraging Tuxedo

5 products

Oncommand Unified Manager

Oncommand Workflow Automation

Snapcenter

Storage Automation Store

Redhat

1 product

Fuse

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Pivotal Software Spring Security	All versions
Vmware Spring Framework	Version 5.0.5

Configuration B

72 vulnerable

Vulnerable Software	Affected Versions
Oracle Agile Plm	Version 9.3.3
Oracle Agile Plm	Version 9.3.4
Oracle Agile Plm	Version 9.3.5
Oracle Agile Plm	Version 9.3.6
Oracle Application Testing Suite	Version 10.1
Oracle Application Testing Suite	Version 12.5.0.3
Oracle Application Testing Suite	Version 13.1.0.1
Oracle Application Testing Suite	Version 13.2.0.1
Oracle Application Testing Suite	Version 13.3.0.1
Oracle Big Data Discovery	Version 1.6.0
Oracle Communications Converged Application Server	Before 7.0.0.1
Oracle Communications Diameter Signaling Router	Before 8.3
Oracle Communications Network Integrity	From 7.3.2 to 7.3.6
Oracle Communications Performance Intelligence Center	Before 10.2.1
Oracle Communications Services Gatekeeper	Before 6.1.0.4.0
Oracle Endeca Information Discovery Integrator	Version 3.1.0
Oracle Endeca Information Discovery Integrator	Version 3.2.0
Oracle Enterprise Manager For Mysql Database	Version 13.2
Oracle Enterprise Manager Ops Center	Version 12.2.2
Oracle Enterprise Manager Ops Center	Version 12.3.3
Oracle Enterprise Repository	Version 11.1.1.7.0
Oracle Enterprise Repository	Version 12.1.3.0.0
Oracle Goldengate For Big Data	Version 12.2.0.1
Oracle Goldengate For Big Data	Version 12.3.1.1
Oracle Goldengate For Big Data	Version 12.3.2.1
Oracle Health Sciences Information Manager	Version 3.0
Oracle Healthcare Master Person Index	Version 3.0
Oracle Healthcare Master Person Index	Version 4.0
Oracle Hospitality Guest Access	Version 4.2.0
Oracle Hospitality Guest Access	Version 4.2.1
Oracle Insurance Calculation Engine	Version 10.1.1
Oracle Insurance Calculation Engine	Version 10.2.1
Oracle Insurance Calculation Engine	Version 10.2
Oracle Insurance Policy Administration	Version 10.0
Oracle Insurance Policy Administration	Version 10.1
Oracle Insurance Policy Administration	Version 10.2
Oracle Insurance Policy Administration	Version 11.0
Oracle Insurance Rules Palette	Version 10.0
Oracle Insurance Rules Palette	Version 10.1
Oracle Insurance Rules Palette	Version 10.2
Oracle Insurance Rules Palette	Version 11.0
Oracle Insurance Rules Palette	Version 11.1
Oracle Micros Lucas	Version 2.9.5
Oracle Mysql Enterprise Monitor	Up to 8.0.2.8191
Oracle Peoplesoft Enterprise Fin Install	Version 9.2
Oracle Retail Assortment Planning	Version 14.1
Oracle Retail Assortment Planning	Version 15.0
Oracle Retail Assortment Planning	Version 16.0
Oracle Retail Back Office	Version 14.0
Oracle Retail Back Office	Version 14.1
Oracle Retail Central Office	Version 14.0
Oracle Retail Central Office	Version 14.1
Oracle Retail Customer Insights	Version 15.0
Oracle Retail Customer Insights	Version 16.0
Oracle Retail Financial Integration	Version 13.2
Oracle Retail Financial Integration	Version 14.0
Oracle Retail Financial Integration	Version 14.1
Oracle Retail Financial Integration	Version 15.0
Oracle Retail Financial Integration	Version 16.0
Oracle Retail Integration Bus	Version 14.1.2
Oracle Retail Point Of Service	Version 14.0
Oracle Retail Point Of Service	Version 14.1
Oracle Retail Returns Management	Version 14.0
Oracle Retail Returns Management	Version 14.1
Oracle Retail Xstore Point Of Service	Version 17.0
Oracle Service Architecture Leveraging Tuxedo	Version 12.1.3.0.0
Oracle Service Architecture Leveraging Tuxedo	Version 12.2.2.0.0
Oracle Tape Library Acsls	Version 8.4
Oracle Weblogic Server	Version 10.3.6.0
Oracle Weblogic Server	Version 12.1.3.0
Oracle Weblogic Server	Version 12.2.1.2
Oracle Weblogic Server	Version 12.2.1.3

Configuration C

6 vulnerable

Vulnerable Software	Affected Versions
Netapp Oncommand Insight	All versions
Netapp Oncommand Unified Manager	From 9.4
Netapp Oncommand Unified Manager	From 7.3
Netapp Oncommand Workflow Automation	All versions
Netapp Snapcenter	All versions
Netapp Storage Automation Store	All versions

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Fuse	Version 7.3.0

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.