CVE-2018-1272 Spring Framework
| Affected software | Spring Framework |
|---|---|
| Severity | 7.5 High CVSS 3.1 2 scores |
| Fixed in | 4.3.15, 5.0.5 |
| Published | 6 Apr 2018 |
| Updated | 17 Jun 2026 |
Description
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.
Exploitation status
No public exploit
No exploit has been reported in the sources we check. Published 8 years ago.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment no assessment published
- Indexed PoC none indexed
- EPSS 3.1% chance in 30 days
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full
- Action available security rule
- Review human Researcher
- Record active
| Decided by | Manual classification of this CVE in the legacy dataset |
|---|---|
| Finding | A manual classification set this CVE's status to Protected by Waratek. |
How to mitigate CVE-2018-1272
Upgrade Spring Framework to a release that fixes it: 4.3.15 or 5.0.5. Until you can, Waratek RASP blocks exploitation with a security rule that blocks this kind of attack. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
7.5 HIGH
v3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
2 metrics
CVSS
7.5 HIGH v3.1CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 7.5 | HIGH | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 2.0 | 6.0 | none | AV:N/AC:M/Au:S/C:P/I:P/A:P |
NVD | Primary |
Affected software and releases
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.springframework:spring-core |
0 | 4.3.15 |
unbounded |
org.springframework:spring-core |
5.0.0 | 5.0.5 |
unbounded |
Products and versions
26 products, 69 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | oracle | application testing suite | generic | 12.5.0.3 · 13.1.0.1 · 13.2.0.1 · 13.3.0.1 |
| nvd | oracle | big data discovery | generic | 1.6.0 |
| nvd | oracle | communications converged application server | generic | ＜ 7.0.0.1 |
| nvd | oracle | communications diameter signaling router | generic | ＜ 8.3 |
| nvd | oracle | communications performance intelligence center | generic | ＜ 10.2.1 |
| nvd | oracle | communications services gatekeeper | generic | ＜ 6.1.0.4.0 |
| nvd | oracle | enterprise manager ops center | generic | 12.2.2 · 12.3.3 |
| nvd | oracle | goldengate for big data | generic | 12.2.0.1 · 12.3.1.1 · 12.3.2.1 |
| nvd | oracle | health sciences information manager | generic | 3.0 |
| nvd | oracle | healthcare master person index | generic | 3.0 · 4.0 |
| nvd | oracle | insurance calculation engine | generic | 10.1.1 · 10.2 · 10.2.1 |
| nvd | oracle | insurance rules palette | generic | 10.0 · 10.1 · 10.2 · 11.0 · 11.1 |
| nvd | oracle | primavera gateway | generic | 15.2 · 16.2 · 17.12 |
| nvd | oracle | retail back office | generic | 14.0 · 14.1 |
| nvd | oracle | retail central office | generic | 14.0 · 14.1 |
| nvd | oracle | retail customer insights | generic | 15.0 · 16.0 |
| nvd | oracle | retail integration bus | generic | 14.0.1 · 14.0.2 · 14.0.3 · 14.0.4 · 14.1.1 · 14.1.2 · 14.1.3 · 15.0.0.1 · 15.0.1 · 15.0.2 · 16.0 · 16.0.1 · 16.0.2 |
| nvd | oracle | retail open commerce platform | generic | 5.3.0 · 6.0.0 · 6.0.1 |
| nvd | oracle | retail order broker | generic | 5.1 · 5.2 · 15.0 · 16.0 |
| nvd | oracle | retail point-of-sale | generic | 14.0 · 14.1 |
| nvd | oracle | retail predictive application server | generic | 14.0 · 14.1 · 15.0 · 16.0 |
| nvd | oracle | retail returns management | generic | 14.0 · 14.1 |
| nvd | oracle | service architecture leveraging tuxedo | generic | 12.1.3.0.0 · 12.2.2.0.0 |
| nvd | oracle | tape library acsls | generic | 8.4 |
| osv | org.springframework | spring-core | generic | ＜ 4.3.15 · ≥ 5.0.0 and ＜ 5.0.5 |
| nvd | vmware | spring framework | generic | ≥ 4.3.0 and ＜ 4.3.15 · ≥ 5.0 and ＜ 5.0.5 |
References
Timeline
Timeline
| Published | 2018-04-06 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |