CVE-2018-1257
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module.
Does this matter?
Lower severity and a low EPSS score (3.24%). Track it; it rarely justifies an emergency change on its own.
Description
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 3.24% probability · 88th percentile
- CISA KEV
- Not listed
- Affected
- vmware/spring framework · redhat/openshift · oracle/agile product lifecycle management · oracle/application testing suite · oracle/big data discovery · oracle/communications converged application server · oracle/communications diameter signaling router · oracle/communications performance intelligence center · oracle/communications services gatekeeper · oracle/communications unified inventory management · oracle/endeca information discovery integrator · oracle/enterprise manager base platform · oracle/enterprise manager for mysql database · oracle/enterprise manager ops center · oracle/flexcube private banking · oracle/goldengate for big data · oracle/health sciences information manager · oracle/healthcare master person index · oracle/hospitality guest access · oracle/insurance calculation engine · +10 more
- Source
- security_alert@emc.com
References
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlPatch, Third Party Advisory
- http://www.securityfocus.com/bid/104260Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2018:1809Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3768Third Party Advisory
- https://pivotal.io/security/cve-2018-1257Vendor Advisory
- https://www.oracle.com/security-alerts/cpujan2020.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2020.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlPatch, Third Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlPatch, Third Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlPatch, Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlPatch, Third Party Advisory
- http://www.securityfocus.com/bid/104260Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2018:1809Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3768Third Party Advisory
- https://pivotal.io/security/cve-2018-1257Vendor Advisory
- https://www.oracle.com/security-alerts/cpujan2020.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2020.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlPatch, Third Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlPatch, Third Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlPatch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.