8.8

CVE-2018-1258

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
VMware ≫ Spring Framework Version 5.0.5
Oracle ≫ Application Testing Suite Version 12.5.0.3
Oracle ≫ Application Testing Suite Version 13.1.0.1
Oracle ≫ Application Testing Suite Version 13.2.0.1
Oracle ≫ Application Testing Suite Version 13.3.0.1
Oracle ≫ Big Data Discovery Version 1.6.0
Oracle ≫ Communications Network Integrity Version >= 7.3.2 <= 7.3.6
Oracle ≫ Enterprise Repository Version 11.1.1.7.0
Oracle ≫ Enterprise Repository Version 12.1.3.0.0
Oracle ≫ Goldengate For Big Data Version 12.2.0.1
Oracle ≫ Goldengate For Big Data Version 12.3.1.1
Oracle ≫ Goldengate For Big Data Version 12.3.2.1
Oracle ≫ Hospitality Guest Access Version 4.2.0
Oracle ≫ Hospitality Guest Access Version 4.2.1
Oracle ≫ Insurance Rules Palette Version 10.0
Oracle ≫ Insurance Rules Palette Version 10.1
Oracle ≫ Insurance Rules Palette Version 10.2
Oracle ≫ Insurance Rules Palette Version 11.0
Oracle ≫ Insurance Rules Palette Version 11.1
Oracle ≫ Micros Lucas Version 2.9.5
Oracle ≫ Mysql Enterprise Monitor Version <= 8.0.2.8191
Oracle ≫ Retail Back Office Version 14.0
Oracle ≫ Retail Back Office Version 14.1
Oracle ≫ Retail Central Office Version 14.0
Oracle ≫ Retail Central Office Version 14.1
Oracle ≫ Retail Customer Insights Version 15.0
Oracle ≫ Retail Customer Insights Version 16.0
Oracle ≫ Retail Integration Bus Version 14.1.2
Oracle ≫ Retail Point-of-service Version 14.0
Oracle ≫ Retail Point-of-service Version 14.1
Oracle ≫ Tape Library Acsls Version 8.4
Oracle ≫ Weblogic Server Version 10.3.6.0
Oracle ≫ Weblogic Server Version 12.1.3.0
Oracle ≫ Weblogic Server Version 12.2.1.2
Oracle ≫ Weblogic Server Version 12.2.1.3
Netapp ≫ Oncommand Insight Version -
Netapp ≫ Oncommand Unified Manager SwPlatform windows Version >= 7.3
Netapp ≫ Oncommand Unified Manager SwPlatform vsphere Version >= 9.4
Netapp ≫ Snapcenter Version -
Redhat ≫ Fuse Version 7.3.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.46% 0.83
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NIST 6.5 8 6.4
AV:N/AC:L/Au:S/C:P/I:P/A:P
CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
Patch
Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2020.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html
Patch
Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
Patch
Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
Patch
Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html
Patch
Third Party Advisory
http://www.securitytracker.com/id/1041888
Third Party Advisory
VDB Entry
https://security.netapp.com/advisory/ntap-20181018-0002/
Third Party Advisory
http://www.securityfocus.com/bid/104222
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1041896
Third Party Advisory
VDB Entry
https://pivotal.io/security/cve-2018-1258
Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:2413
Patch
Third Party Advisory