7.5

CVE-2018-1272

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
VMware ≫ Spring Framework Version >= 4.3.0 < 4.3.15
VMware ≫ Spring Framework Version >= 5.0 < 5.0.5
Oracle ≫ Application Testing Suite Version 12.5.0.3
Oracle ≫ Application Testing Suite Version 13.1.0.1
Oracle ≫ Application Testing Suite Version 13.2.0.1
Oracle ≫ Application Testing Suite Version 13.3.0.1
Oracle ≫ Big Data Discovery Version 1.6.0
Oracle ≫ Goldengate For Big Data Version 12.2.0.1
Oracle ≫ Goldengate For Big Data Version 12.3.1.1
Oracle ≫ Goldengate For Big Data Version 12.3.2.1
Oracle ≫ Insurance Rules Palette Version 10.0
Oracle ≫ Insurance Rules Palette Version 10.1
Oracle ≫ Insurance Rules Palette Version 10.2
Oracle ≫ Insurance Rules Palette Version 11.0
Oracle ≫ Insurance Rules Palette Version 11.1
Oracle ≫ Primavera Gateway Version 15.2
Oracle ≫ Primavera Gateway Version 16.2
Oracle ≫ Primavera Gateway Version 17.12
Oracle ≫ Retail Back Office Version 14.0
Oracle ≫ Retail Back Office Version 14.1
Oracle ≫ Retail Central Office Version 14.0
Oracle ≫ Retail Central Office Version 14.1
Oracle ≫ Retail Customer Insights Version 15.0
Oracle ≫ Retail Customer Insights Version 16.0
Oracle ≫ Retail Integration Bus Version 14.0.1
Oracle ≫ Retail Integration Bus Version 14.0.2
Oracle ≫ Retail Integration Bus Version 14.0.3
Oracle ≫ Retail Integration Bus Version 14.0.4
Oracle ≫ Retail Integration Bus Version 14.1.1
Oracle ≫ Retail Integration Bus Version 14.1.2
Oracle ≫ Retail Integration Bus Version 14.1.3
Oracle ≫ Retail Integration Bus Version 15.0.0.1
Oracle ≫ Retail Integration Bus Version 15.0.1
Oracle ≫ Retail Integration Bus Version 15.0.2
Oracle ≫ Retail Integration Bus Version 16.0
Oracle ≫ Retail Integration Bus Version 16.0.1
Oracle ≫ Retail Integration Bus Version 16.0.2
Oracle ≫ Retail Order Broker Version 5.1
Oracle ≫ Retail Order Broker Version 5.2
Oracle ≫ Retail Order Broker Version 15.0
Oracle ≫ Retail Order Broker Version 16.0
Oracle ≫ Retail Point-of-sale Version 14.0
Oracle ≫ Retail Point-of-sale Version 14.1
Oracle ≫ Tape Library Acsls Version 8.4
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.09% 0.861
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 1.6 5.9
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NIST 6 6.8 6.4
AV:N/AC:M/Au:S/C:P/I:P/A:P
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
Patch
Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html
Patch
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2669
Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
Patch
Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html
Patch
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1320
Third Party Advisory
http://www.securityfocus.com/bid/103697
Third Party Advisory
VDB Entry
https://pivotal.io/security/cve-2018-1272
Vendor Advisory