Pivotal Software Spring Advanced Message Queuing Protocol CVEs

Protected by Waratek 1 50.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 1 50.0%

Critical 1 50.0% High 0 0.0% Medium 1 50.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 1 50.0% partly blocked 0 0.0% not blocked 1 50.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 2 100.0%

split by StatusSeverityProtectionExploit maturity peak 1 / month

Nov 171 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 Dec 170 Jan 180 Feb 180 Mar 180 Apr 180 May 180 Jun 180 Jul 180 Aug 180 Sep 181 No exploit published1 Medium1 not blocked1 No public exploit1

Nov 17Dec 17Jan 18Feb 18Mar 18Apr 18May 18Jun 18Jul 18Aug 18Sep 18

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2018-11087	Medium	2018-09-14	No exploit published	No public exploit	Pivotal Spring AMQP, 1.x versions prior to 1.7.10 and 2.x versions prior to 2.0.6, expose a man-in-the-middle vulnerability due to lack of hostname validation. A malicious user that has the ability to intercept traffic would be able to view data in transit.
CVE-2017-8045	Critical	2017-11-27	Protected by Waratek	No public exploit	In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized when being converted into a string. A malicious payload could be crafted to exploit this and enable a remote code execution attack.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2018-11087

Medium

2018-09-14

No exploit published

No public exploit

Pivotal Spring AMQP, 1.x versions prior to 1.7.10 and 2.x versions prior to 2.0.6, expose a man-in-the-middle vulnerability due to lack of hostname validation. A malicious user that has the ability to intercept traffic would be able to view data in transit.

CVE-2017-8045

Critical

2017-11-27

Protected by Waratek

No public exploit

In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized when being converted into a string. A malicious payload could be crafted to exploit this and enable a remote code execution attack.