WaratekVRT Sign in

CVE-2018-1258

Affected software12 products, listed below
Severity8.8 High CVSS 3.1 2 scores
Fixed in5.0.6.RELEASE
WeaknessIncorrect authorization (CWE-863)
Published11 May 2018
Updated25 Aug 2026

Description

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 8 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 2.5% chance in 30 days

Waratek protection

No exploit published

Within Waratek scope. In the sources we check, nobody has published exploit code for this CVE or reported it being exploited.

VRT has not found a public code change for this CVE yet.

  • Protection none
  • Action not pursued
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to No source fix or exploit.

CVSS

8.8 HIGH v3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 2.0 6.5 none AV:N/AC:L/Au:S/C:P/I:P/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update July 2020 ↗ CPU 2020-Q3 Oracle Communications Applications / Core (Spring Framework) (7.3.2-7.3.6)
Oracle Critical Patch Update April 2020 ↗ CPU 2020-Q2 Oracle Retail Applications / Xenvironment (jackson-databind) (17.0)
Oracle Critical Patch Update January 2020 ↗ CPU 2020-Q1 Oracle Retail Applications / Common Component Integration (Spring Framework) (13.4.4)
Oracle Retail Applications / Dataset Component (Spring Framework) (14.0.5)
Oracle Critical Patch Update July 2019 ↗ CPU 2019-Q3 Oracle Retail Applications / Install (Spring Framework) (16.0.1)
Oracle Retail Applications / RPAS Fusion Client (Spring Framework) (14.0.3.26, 14.1.3.37, 15.0.3.100)
Oracle Retail Applications / RPAS Fusion Client (Spring Framework) (16.0)
Oracle Critical Patch Update April 2019 ↗ CPU 2019-Q2 Oracle Communications Applications / Security (Spring Framework) (7.3.2, 7.3.4, 7.3.5, 7.4.0)
Oracle Enterprise Manager Products Suite / Enterprise Manager Install (Spring Framework) (12.1.0.5.0, 13.2.0.0.0, 13.3.0.0.0)
Oracle Enterprise Manager Products Suite / Networking (Spring Framework) (12.3.3)
Oracle Financial Services Applications / Core (Spring Framework) (2.0.0.0, 2.2.0.1, 12.0.1.0, 12.0.3.0, 12.1.0.0)
Oracle Fusion Middleware / WLS Core Components (Spring Framework) (12.2.1.3.0)
Oracle Utilities Applications / Web Gateway client (Spring Framework) (1.12.0.3)
Oracle Critical Patch Update January 2019 ↗ CPU 2019-Q1 Oracle Communications Applications / Security (Spring Framework) (prior to 10.2.1)
Oracle Communications Applications / Security (Spring Framework) (prior to 6.1.0.4.0)
Oracle Communications Applications / Security (Spring Framework) (prior to 8.3)
Oracle Enterprise Manager Products Suite / Load Testing for Web Apps (Spring Framework) (12.5.0.3, 13.1.0.1, 13.2.0.1, 13.3.0.1)
Oracle Health Sciences Applications / Core (Spring Framework) (3.0, 4.0)
Oracle Health Sciences Applications / Health Policy Engine (Spring Framework) (3.0)
Oracle Insurance Applications / Core (Spring Framework) (10.0, 10.2)
Oracle Insurance Applications / Core (Spring Framework) (10.2)
Oracle Retail Applications / Other (Spring Framework) (15.0, 16.0)
Oracle Critical Patch Update October 2018 ↗ CPU 2018-Q4 Oracle Enterprise Manager Products Suite / EM Plugin: General (Spring Framework) (13.2)
Oracle Fusion Middleware / Other Issues (Spring Framework) (3.1.0, 3.2.0)
Oracle Fusion Middleware / Sample apps (Spring Framework) (10.3.6.0, 12.1.3.0, 12.2.1.3)
Oracle Hospitality Applications / Base (Spring Framework) (4.2.0, 4.2.1)
Oracle MySQL / Monitoring: General (Spring Framework) (3.4.9.4237 and prior, 4.0.6.5281 and prior, 8.0.2.8191 and prior)
Oracle Retail Applications / Application Core (Spring Framework) (14.1, 15.0, 16.0)
Oracle Retail Applications / PeopleSoft Integration Bugs (Spring Framework) (13.2, 14.0, 14.1, 15.0, 16.0)
Oracle Retail Applications / RIB Kernal (Spring Framework) (14.1.2)
Oracle Retail Applications / Security (Spring Framework) (2.9.5)
Oracle Supply Chain Products Suite / Application Server (Spring Framework) (9.3.3, 9.3.4, 9.3.5, 9.3.6)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Communications Applications Core (Spring Framework) 7.3.2-7.3.6
Oracle Communications Applications Security (Spring Framework) prior to 6.1.0.4.0 7.3.2 · 7.3.4 · 7.3.5 · 7.4.0
Oracle Enterprise Manager Products Suite EM Plugin: General (Spring Framework) 13.2 13.2
Oracle Enterprise Manager Products Suite Enterprise Manager Install (Spring Framework) 12.1.0.5.0, 13.2.0.0.0, 13.3.0.0.0 12.1.0.5.0 · 13.2.0.0.0 · 13.3.0.0.0
Oracle Enterprise Manager Products Suite Load Testing for Web Apps (Spring Framework) 12.5.0.3, 13.1.0.1, 13.2.0.1, 13.3.0.1 12.5.0.3 · 13.1.0.1 · 13.2.0.1 · 13.3.0.1
Oracle Enterprise Manager Products Suite Networking (Spring Framework) 12.3.3 12.3.3
Oracle Financial Services Applications Core (Spring Framework) 2.0.0.0, 2.2.0.1, 12.0.1.0, 12.0.3.0, 12.1.0.0 2.0.0.0 · 2.2.0.1 · 12.0.1.0 · 12.0.3.0 · 12.1.0.0
Oracle Fusion Middleware Other Issues (Spring Framework) 3.1.0, 3.2.0 3.1.0 · 3.2.0
Oracle Fusion Middleware Sample apps (Spring Framework) 10.3.6.0, 12.1.3.0, 12.2.1.3 10.3.6.0 · 12.1.3.0 · 12.2.1.3
Oracle Fusion Middleware WLS Core Components (Spring Framework) 12.2.1.3.0 12.2.1.3.0
Oracle Health Sciences Applications Core (Spring Framework) 3.0, 4.0 3.0 · 4.0
Oracle Health Sciences Applications Health Policy Engine (Spring Framework) 3.0 3.0
Oracle Hospitality Applications Base (Spring Framework) 4.2.0, 4.2.1 4.2.0 · 4.2.1
Oracle Insurance Applications Core (Spring Framework) 10.0, 10.2 10.0 · 10.2
Oracle MySQL Monitoring: General (Spring Framework) 3.4.9.4237 and prior, 4.0.6.5281 and prior, 8.0.2.8191 and prior
Oracle Retail Applications Application Core (Spring Framework) 14.1, 15.0, 16.0 14.1 · 15.0 · 16.0
Oracle Retail Applications Common Component Integration (Spring Framework) 13.4.4 13.4.4
Oracle Retail Applications Dataset Component (Spring Framework) 14.0.5 14.0.5
Oracle Retail Applications Install (Spring Framework) 16.0.1 16.0.1
Oracle Retail Applications Other (Spring Framework) 15.0, 16.0 15.0 · 16.0
Oracle Retail Applications PeopleSoft Integration Bugs (Spring Framework) 13.2, 14.0, 14.1, 15.0, 16.0 13.2 · 14.0 · 14.1 · 15.0 · 16.0
Oracle Retail Applications RIB Kernal (Spring Framework) 14.1.2 14.1.2
Oracle Retail Applications RPAS Fusion Client (Spring Framework) 14.0.3.26, 14.1.3.37, 15.0.3.100 14.0.3.26 · 14.1.3.37 · 15.0.3.100 · 16.0
Oracle Retail Applications Security (Spring Framework) 2.9.5 2.9.5
Oracle Retail Applications Xenvironment (jackson-databind) 17.0 17.0
Oracle Supply Chain Products Suite Application Server (Spring Framework) 9.3.3, 9.3.4, 9.3.5, 9.3.6 9.3.3 · 9.3.4 · 9.3.5 · 9.3.6
Oracle Utilities Applications Web Gateway client (Spring Framework) 1.12.0.3 1.12.0.3

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.springframework:spring-core 5.0.5.RELEASE 5.0.6.RELEASE unbounded

Products and versions

43 products, 82 version entries
SourceVendorProductSchemeAffected versions
nvd netapp oncommand insight generic any version
nvd netapp oncommand unified manager generic ≥ 7.3 · ≥ 9.4
nvd netapp oncommand workflow automation generic any version
nvd netapp snapcenter generic any version
nvd netapp storage automation store generic any version
nvd oracle agile product lifecycle management generic 9.3.3 · 9.3.4 · 9.3.5 · 9.3.6
nvd oracle application testing suite generic 10.1 · 12.5.0.3 · 13.1.0.1 · 13.2.0.1 · 13.3.0.1
nvd oracle big data discovery generic 1.6.0
nvd oracle communications converged application server generic ＜ 7.0.0.1
nvd oracle communications diameter signaling router generic ＜ 8.3
nvd oracle communications network integrity generic ≥ 7.3.2 and ≤ 7.3.6
nvd oracle communications performance intelligence center generic ＜ 10.2.1
nvd oracle communications services gatekeeper generic ＜ 6.1.0.4.0
nvd oracle endeca information discovery integrator generic 3.1.0 · 3.2.0
nvd oracle enterprise manager for mysql database generic 13.2
nvd oracle enterprise manager ops center generic 12.2.2 · 12.3.3
nvd oracle enterprise repository generic 11.1.1.7.0 · 12.1.3.0.0
nvd oracle goldengate for big data generic 12.2.0.1 · 12.3.1.1 · 12.3.2.1
nvd oracle health sciences information manager generic 3.0
nvd oracle healthcare master person index generic 3.0 · 4.0
nvd oracle hospitality guest access generic 4.2.0 · 4.2.1
nvd oracle insurance calculation engine generic 10.1.1 · 10.2 · 10.2.1
nvd oracle insurance policy administration generic 10.0 · 10.1 · 10.2 · 11.0
nvd oracle insurance rules palette generic 10.0 · 10.1 · 10.2 · 11.0 · 11.1
nvd oracle micros lucas generic 2.9.5
nvd oracle mysql enterprise monitor generic ≤ 8.0.2.8191
nvd oracle peoplesoft enterprise fin install generic 9.2
nvd oracle retail assortment planning generic 14.1 · 15.0 · 16.0
nvd oracle retail back office generic 14.0 · 14.1
nvd oracle retail central office generic 14.0 · 14.1
nvd oracle retail customer insights generic 15.0 · 16.0
nvd oracle retail financial integration generic 13.2 · 14.0 · 14.1 · 15.0 · 16.0
nvd oracle retail integration bus generic 14.1.2
nvd oracle retail point-of-service generic 14.0 · 14.1
nvd oracle retail returns management generic 14.0 · 14.1
nvd oracle retail xstore point of service generic 17.0
nvd oracle service architecture leveraging tuxedo generic 12.1.3.0.0 · 12.2.2.0.0
nvd oracle tape library acsls generic 8.4
nvd oracle weblogic server generic 10.3.6.0 · 12.1.3.0 · 12.2.1.2 · 12.2.1.3
osv org.springframework spring-core generic ≥ 5.0.5 and ＜ 5.0.6
nvd pivotal software spring security generic any version
nvd redhat fuse generic 7.3.0
nvd vmware spring framework generic 5.0.5

Earlier manual review

A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** HTTP, HTTPS **Products:** SPRINGFRAMEWORK, SPRING-SECURITY-CORE

References

URLTags
https://github.com/spring-projects/spring-framework/commit/7b8fa90d96aaf751a3256fa755d5f17e081c20f1 WEB
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html WEB
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html WEB
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html WEB
https://www.oracle.com/security-alerts/cpuoct2021.html WEB
https://www.oracle.com/security-alerts/cpujul2020.html WEB
https://www.oracle.com/security-alerts/cpujan2021.html WEB
https://www.oracle.com/security-alerts/cpujan2020.html WEB
https://www.oracle.com/security-alerts/cpuapr2020.html WEB
https://web.archive.org/web/20200807033751/http://www.securitytracker.com/id/1041896 WEB

Timeline
Published2018-05-11By the CVE Program.
NVD record modified2026-08-25NVD's own last-modified date for this record.