{"id":"CVE-2018-1258","url":"https://www.cyber-defence.io/tools/cve/CVE-2018-1258","generatedAt":"2026-10-28T22:21:10.004Z","title":"Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security.","description":"Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.","published":"2018-05-11T20:29:00.000Z","lastModified":"2026-08-25T16:28:27.000Z","status":"Modified","sourceIdentifier":"security_alert@emc.com","cvss":{"version":"3.1","score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-863"],"affected":["pivotal software/spring security","vmware/spring framework","oracle/agile product lifecycle management","oracle/application testing suite","oracle/big data discovery","oracle/communications converged application server","oracle/communications diameter signaling router","oracle/communications network integrity","oracle/communications performance intelligence center","oracle/communications services gatekeeper","oracle/endeca information discovery integrator","oracle/enterprise manager for mysql database","oracle/enterprise manager ops center","oracle/enterprise repository","oracle/goldengate for big data","oracle/health sciences information manager","oracle/healthcare master person index","oracle/hospitality guest access","oracle/insurance calculation engine","oracle/insurance policy administration","oracle/insurance rules palette","oracle/micros lucas","oracle/mysql enterprise monitor","oracle/peoplesoft enterprise fin install","oracle/retail assortment planning","oracle/retail back office","oracle/retail central office","oracle/retail customer insights","oracle/retail financial integration","oracle/retail integration bus","oracle/retail point-of-service","oracle/retail returns management","oracle/retail xstore point of service","oracle/service architecture leveraging tuxedo","oracle/tape library acsls","oracle/weblogic server","netapp/oncommand insight","netapp/oncommand unified manager","netapp/oncommand workflow automation","netapp/snapcenter","netapp/storage automation store","redhat/fuse"],"epss":{"score":0.02461,"percentile":0.84368,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (2.46%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["Patch","Third Party Advisory"],"source":"security_alert@emc.com"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","tags":["Patch","Third Party Advisory"],"source":"security_alert@emc.com"},{"url":"http://www.securityfocus.com/bid/104222","tags":["Third Party Advisory","VDB Entry"],"source":"security_alert@emc.com"},{"url":"http://www.securitytracker.com/id/1041888","tags":["Third Party Advisory","VDB Entry"],"source":"security_alert@emc.com"},{"url":"http://www.securitytracker.com/id/1041896","tags":["Third Party Advisory","VDB Entry"],"source":"security_alert@emc.com"},{"url":"https://access.redhat.com/errata/RHSA-2019:2413","tags":["Patch","Third Party Advisory"],"source":"security_alert@emc.com"},{"url":"https://pivotal.io/security/cve-2018-1258","tags":["Vendor Advisory"],"source":"security_alert@emc.com"},{"url":"https://security.netapp.com/advisory/ntap-20181018-0002/","tags":["Third Party Advisory"],"source":"security_alert@emc.com"},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["Patch","Third Party Advisory"],"source":"security_alert@emc.com"},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["Patch","Third Party Advisory"],"source":"security_alert@emc.com"},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["Patch","Third Party Advisory"],"source":"security_alert@emc.com"},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","tags":["Patch","Third Party Advisory"],"source":"security_alert@emc.com"},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["Patch","Third Party Advisory"],"source":"security_alert@emc.com"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["Patch","Third Party Advisory"],"source":"security_alert@emc.com"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","tags":["Patch","Third Party Advisory"],"source":"security_alert@emc.com"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["Patch","Third Party Advisory"],"source":"security_alert@emc.com"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/104222","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id/1041888","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id/1041896","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:2413","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://pivotal.io/security/cve-2018-1258","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20181018-0002/","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-1258","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}