CVE-2018-1258
Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.
- Score
- CVSS 3.1 8.8 High
- Status
- Modified - security_alert@emc.com
- Published
- 2018-05-11
- Last modified
- 2024-09-17
- Weaknesses
- CWE-863
Affected products
- Oncommand Insight (Netapp)
- Oncommand Unified Manager (Netapp)
- Oncommand Workflow Automation (Netapp)
- Snapcenter (Netapp)
- Storage Automation Store (Netapp)
- Agile Product Lifecycle Management (Oracle)
- Application Testing Suite (Oracle)
- Big Data Discovery (Oracle)
- Communications Converged Application Server (Oracle)
- Communications Diameter Signaling Router (Oracle)
- Communications Network Integrity (Oracle)
- Communications Performance Intelligence Center (Oracle)
- Communications Services Gatekeeper (Oracle)
- Endeca Information Discovery Integrator (Oracle)
- Enterprise Manager For Mysql Database (Oracle)
- Enterprise Manager Ops Center (Oracle)
- Enterprise Repository (Oracle)
- Goldengate For Big Data (Oracle)
- Health Sciences Information Manager (Oracle)
- Healthcare Master Person Index (Oracle)
- Hospitality Guest Access (Oracle)
- Insurance Calculation Engine (Oracle)
- Insurance Policy Administration (Oracle)
- Insurance Rules Palette (Oracle)
- Micros Lucas (Oracle)
- Mysql Enterprise Monitor (Oracle)
- Peoplesoft Enterprise Fin Install (Oracle)
- Retail Assortment Planning (Oracle)
- Retail Back Office (Oracle)
- Retail Central Office (Oracle)
- Retail Customer Insights (Oracle)
- Retail Financial Integration (Oracle)
- Retail Integration Bus (Oracle)
- Retail Point-of-service (Oracle)
- Retail Returns Management (Oracle)
- Retail Xstore Point Of Service (Oracle)
- Service Architecture Leveraging Tuxedo (Oracle)
- Tape Library Acsls (Oracle)
- Weblogic Server (Oracle)
- Spring Framework (Pivotal)
- Spring Security (Pivotal Software)
- Fuse (Redhat)
- Spring Framework (Vmware)
References
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.securityfocus.com/bid/104222
- http://www.securitytracker.com/id/1041888
- http://www.securitytracker.com/id/1041896
- https://access.redhat.com/errata/RHSA-2019:2413
- https://pivotal.io/security/cve-2018-1258
- https://security.netapp.com/advisory/ntap-20181018-0002/
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
