CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2018-1272

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.022

EPSS Ranking 83.6%

CVSS Severity

CVSS v3 Score 7.5

CVSS v2 Score 6.0

References

Products affected by CVE-2018-1272

Oracle » Application Testing Suite » Version: 12.5.0.3

cpe:2.3:a:oracle:application_testing_suite:12.5.0.3
Oracle » Application Testing Suite » Version: 13.1.0.1

cpe:2.3:a:oracle:application_testing_suite:13.1.0.1
Oracle » Application Testing Suite » Version: 13.2.0.1

cpe:2.3:a:oracle:application_testing_suite:13.2.0.1
Oracle » Application Testing Suite » Version: 13.3.0.1

cpe:2.3:a:oracle:application_testing_suite:13.3.0.1
Oracle » Big Data Discovery » Version: 1.6.0

cpe:2.3:a:oracle:big_data_discovery:1.6.0
Oracle » Communications Converged Application Server » Version: 4.0

cpe:2.3:a:oracle:communications_converged_application_server:4.0
Oracle » Communications Converged Application Server » Version: 5.0

cpe:2.3:a:oracle:communications_converged_application_server:5.0
Oracle » Communications Converged Application Server » Version: 5.1

cpe:2.3:a:oracle:communications_converged_application_server:5.1
Oracle » Communications Converged Application Server » Version: 7.0

cpe:2.3:a:oracle:communications_converged_application_server:7.0
Oracle » Communications Diameter Signaling Router » Version: N/A

cpe:2.3:a:oracle:communications_diameter_signaling_router:-
Oracle » Communications Diameter Signaling Router » Version: 6.0

cpe:2.3:a:oracle:communications_diameter_signaling_router:6.0
Oracle » Communications Diameter Signaling Router » Version: 8.0

cpe:2.3:a:oracle:communications_diameter_signaling_router:8.0
Oracle » Communications Diameter Signaling Router » Version: 8.0.0

cpe:2.3:a:oracle:communications_diameter_signaling_router:8.0.0
Oracle » Communications Diameter Signaling Router » Version: 8.0.0.0

cpe:2.3:a:oracle:communications_diameter_signaling_router:8.0.0.0
Oracle » Communications Diameter Signaling Router » Version: 8.1

cpe:2.3:a:oracle:communications_diameter_signaling_router:8.1
Oracle » Communications Diameter Signaling Router » Version: 8.2

cpe:2.3:a:oracle:communications_diameter_signaling_router:8.2
Oracle » Communications Diameter Signaling Router » Version: 8.2.1

cpe:2.3:a:oracle:communications_diameter_signaling_router:8.2.1
Oracle » Communications Diameter Signaling Router » Version: 8.2.2

cpe:2.3:a:oracle:communications_diameter_signaling_router:8.2.2
Oracle » Communications Performance Intelligence Center » Version: Any

cpe:2.3:a:oracle:communications_performance_intelligence_center:*
Oracle » Communications Services Gatekeeper » Version: 6.0

cpe:2.3:a:oracle:communications_services_gatekeeper:6.0
Oracle » Communications Services Gatekeeper » Version: 6.1

cpe:2.3:a:oracle:communications_services_gatekeeper:6.1
Oracle » Enterprise Manager Ops Center » Version: 12.2.2

cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.2
Oracle » Enterprise Manager Ops Center » Version: 12.3.3

cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3
Oracle » Goldengate For Big Data » Version: 12.2.0.1

cpe:2.3:a:oracle:goldengate_for_big_data:12.2.0.1
Oracle » Goldengate For Big Data » Version: 12.3.1.1

cpe:2.3:a:oracle:goldengate_for_big_data:12.3.1.1
Oracle » Goldengate For Big Data » Version: 12.3.2.1

cpe:2.3:a:oracle:goldengate_for_big_data:12.3.2.1
Oracle » Health Sciences Information Manager » Version: 3.0

cpe:2.3:a:oracle:health_sciences_information_manager:3.0
Oracle » Healthcare Master Person Index » Version: 3.0

cpe:2.3:a:oracle:healthcare_master_person_index:3.0
Oracle » Healthcare Master Person Index » Version: 4.0

cpe:2.3:a:oracle:healthcare_master_person_index:4.0
Oracle » Insurance Calculation Engine » Version: 10.1.1

cpe:2.3:a:oracle:insurance_calculation_engine:10.1.1
Oracle » Insurance Calculation Engine » Version: 10.2

cpe:2.3:a:oracle:insurance_calculation_engine:10.2
Oracle » Insurance Calculation Engine » Version: 10.2.1

cpe:2.3:a:oracle:insurance_calculation_engine:10.2.1
Oracle » Insurance Rules Palette » Version: 10.0

cpe:2.3:a:oracle:insurance_rules_palette:10.0
Oracle » Insurance Rules Palette » Version: 10.1

cpe:2.3:a:oracle:insurance_rules_palette:10.1
Oracle » Insurance Rules Palette » Version: 10.2

cpe:2.3:a:oracle:insurance_rules_palette:10.2
Oracle » Insurance Rules Palette » Version: 11.0

cpe:2.3:a:oracle:insurance_rules_palette:11.0
Oracle » Insurance Rules Palette » Version: 11.1

cpe:2.3:a:oracle:insurance_rules_palette:11.1
Oracle » Primavera Gateway » Version: 15.2

cpe:2.3:a:oracle:primavera_gateway:15.2
Oracle » Primavera Gateway » Version: 16.2

cpe:2.3:a:oracle:primavera_gateway:16.2
Oracle » Primavera Gateway » Version: 17.12

cpe:2.3:a:oracle:primavera_gateway:17.12
Oracle » Retail Back Office » Version: 14.0

cpe:2.3:a:oracle:retail_back_office:14.0
Oracle » Retail Back Office » Version: 14.1

cpe:2.3:a:oracle:retail_back_office:14.1
Oracle » Retail Central Office » Version: 14.0

cpe:2.3:a:oracle:retail_central_office:14.0
Oracle » Retail Central Office » Version: 14.1

cpe:2.3:a:oracle:retail_central_office:14.1
Oracle » Retail Customer Insights » Version: 15.0

cpe:2.3:a:oracle:retail_customer_insights:15.0
Oracle » Retail Customer Insights » Version: 16.0

cpe:2.3:a:oracle:retail_customer_insights:16.0
Oracle » Retail Integration Bus » Version: 14.0.1

cpe:2.3:a:oracle:retail_integration_bus:14.0.1
Oracle » Retail Integration Bus » Version: 14.0.2

cpe:2.3:a:oracle:retail_integration_bus:14.0.2
Oracle » Retail Integration Bus » Version: 14.0.3

cpe:2.3:a:oracle:retail_integration_bus:14.0.3
Oracle » Retail Integration Bus » Version: 14.0.4

cpe:2.3:a:oracle:retail_integration_bus:14.0.4
Oracle » Retail Integration Bus » Version: 14.1.1

cpe:2.3:a:oracle:retail_integration_bus:14.1.1
Oracle » Retail Integration Bus » Version: 14.1.2

cpe:2.3:a:oracle:retail_integration_bus:14.1.2
Oracle » Retail Integration Bus » Version: 14.1.3

cpe:2.3:a:oracle:retail_integration_bus:14.1.3
Oracle » Retail Integration Bus » Version: 15.0.0.1

cpe:2.3:a:oracle:retail_integration_bus:15.0.0.1
Oracle » Retail Integration Bus » Version: 15.0.1

cpe:2.3:a:oracle:retail_integration_bus:15.0.1
Oracle » Retail Integration Bus » Version: 15.0.2

cpe:2.3:a:oracle:retail_integration_bus:15.0.2
Oracle » Retail Integration Bus » Version: 16.0

cpe:2.3:a:oracle:retail_integration_bus:16.0
Oracle » Retail Integration Bus » Version: 16.0.1

cpe:2.3:a:oracle:retail_integration_bus:16.0.1
Oracle » Retail Integration Bus » Version: 16.0.2

cpe:2.3:a:oracle:retail_integration_bus:16.0.2
Oracle » Retail Open Commerce Platform » Version: 5.3.0

cpe:2.3:a:oracle:retail_open_commerce_platform:5.3.0
Oracle » Retail Open Commerce Platform » Version: 6.0.0

cpe:2.3:a:oracle:retail_open_commerce_platform:6.0.0
Oracle » Retail Open Commerce Platform » Version: 6.0.1

cpe:2.3:a:oracle:retail_open_commerce_platform:6.0.1
Oracle » Retail Order Broker » Version: 15.0

cpe:2.3:a:oracle:retail_order_broker:15.0
Oracle » Retail Order Broker » Version: 16.0

cpe:2.3:a:oracle:retail_order_broker:16.0
Oracle » Retail Order Broker » Version: 5.1

cpe:2.3:a:oracle:retail_order_broker:5.1
Oracle » Retail Order Broker » Version: 5.2

cpe:2.3:a:oracle:retail_order_broker:5.2
Oracle » Retail Point-Of-Sale » Version: 14.0

cpe:2.3:a:oracle:retail_point-of-sale:14.0
Oracle » Retail Point-Of-Sale » Version: 14.1

cpe:2.3:a:oracle:retail_point-of-sale:14.1
Oracle » Retail Predictive Application Server » Version: 14.0

cpe:2.3:a:oracle:retail_predictive_application_server:14.0
Oracle » Retail Predictive Application Server » Version: 14.1

cpe:2.3:a:oracle:retail_predictive_application_server:14.1
Oracle » Retail Predictive Application Server » Version: 15.0

cpe:2.3:a:oracle:retail_predictive_application_server:15.0
Oracle » Retail Predictive Application Server » Version: 16.0

cpe:2.3:a:oracle:retail_predictive_application_server:16.0
Oracle » Retail Returns Management » Version: 14.0

cpe:2.3:a:oracle:retail_returns_management:14.0
Oracle » Retail Returns Management » Version: 14.1

cpe:2.3:a:oracle:retail_returns_management:14.1
Oracle » Service Architecture Leveraging Tuxedo » Version: 12.1.3.0.0

cpe:2.3:a:oracle:service_architecture_leveraging_tuxedo:12.1.3.0.0
Oracle » Service Architecture Leveraging Tuxedo » Version: 12.2.2.0.0

cpe:2.3:a:oracle:service_architecture_leveraging_tuxedo:12.2.2.0.0
Oracle » Tape Library Acsls » Version: 8.4

cpe:2.3:a:oracle:tape_library_acsls:8.4
Vmware » Spring Framework » Version: 4.3.0

cpe:2.3:a:vmware:spring_framework:4.3.0
Vmware » Spring Framework » Version: 4.3.1

cpe:2.3:a:vmware:spring_framework:4.3.1
Vmware » Spring Framework » Version: 4.3.10

cpe:2.3:a:vmware:spring_framework:4.3.10
Vmware » Spring Framework » Version: 4.3.11

cpe:2.3:a:vmware:spring_framework:4.3.11
Vmware » Spring Framework » Version: 4.3.12

cpe:2.3:a:vmware:spring_framework:4.3.12
Vmware » Spring Framework » Version: 4.3.13

cpe:2.3:a:vmware:spring_framework:4.3.13
Vmware » Spring Framework » Version: 4.3.14

cpe:2.3:a:vmware:spring_framework:4.3.14
Vmware » Spring Framework » Version: 4.3.2

cpe:2.3:a:vmware:spring_framework:4.3.2
Vmware » Spring Framework » Version: 4.3.3

cpe:2.3:a:vmware:spring_framework:4.3.3
Vmware » Spring Framework » Version: 4.3.4

cpe:2.3:a:vmware:spring_framework:4.3.4
Vmware » Spring Framework » Version: 4.3.5

cpe:2.3:a:vmware:spring_framework:4.3.5
Vmware » Spring Framework » Version: 4.3.6

cpe:2.3:a:vmware:spring_framework:4.3.6
Vmware » Spring Framework » Version: 4.3.7

cpe:2.3:a:vmware:spring_framework:4.3.7
Vmware » Spring Framework » Version: 4.3.8

cpe:2.3:a:vmware:spring_framework:4.3.8
Vmware » Spring Framework » Version: 4.3.9

cpe:2.3:a:vmware:spring_framework:4.3.9
Vmware » Spring Framework » Version: 5.0.0

cpe:2.3:a:vmware:spring_framework:5.0.0
Vmware » Spring Framework » Version: 5.0.1

cpe:2.3:a:vmware:spring_framework:5.0.1
Vmware » Spring Framework » Version: 5.0.2

cpe:2.3:a:vmware:spring_framework:5.0.2
Vmware » Spring Framework » Version: 5.0.3

cpe:2.3:a:vmware:spring_framework:5.0.3
Vmware » Spring Framework » Version: 5.0.4

cpe:2.3:a:vmware:spring_framework:5.0.4

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2018-1272

Products

Pricing

Contact Us