SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2018-1257

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module.

MEDIUM 6.5EPSS 3.24%

Does this matter?

Lower severity and a low EPSS score (3.24%). Track it; it rarely justifies an emergency change on its own.

Description

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.

CVSS 3.1
6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS
3.24% probability · 88th percentile
CISA KEV
Not listed
Affected
vmware/spring framework · redhat/openshift · oracle/agile product lifecycle management · oracle/application testing suite · oracle/big data discovery · oracle/communications converged application server · oracle/communications diameter signaling router · oracle/communications performance intelligence center · oracle/communications services gatekeeper · oracle/communications unified inventory management · oracle/endeca information discovery integrator · oracle/enterprise manager base platform · oracle/enterprise manager for mysql database · oracle/enterprise manager ops center · oracle/flexcube private banking · oracle/goldengate for big data · oracle/health sciences information manager · oracle/healthcare master person index · oracle/hospitality guest access · oracle/insurance calculation engine · +10 more
Source
security_alert@emc.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.