CVE-2018-15756 Spring Framework
| Affected software | Spring Framework |
|---|---|
| Severity | 7.5 High CVSS 3.1 3 scores |
| Fixed in | 5.1.1.RELEASE, 5.0.10.RELEASE, 4.3.20.RELEASE |
| Published | 18 Oct 2018 |
| Updated | 8 Oct 2026 |
Description
Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.
Exploitation status
No public exploit
No exploit has been reported in the sources we check. Published 8 years ago.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: none
- Indexed PoC none indexed
- EPSS 8.8% chance in 30 days
Waratek protection
A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.
- Protection none
- Action not pursued none
- Review human Researcher
- Record active
| Decided by | Manual classification of this CVE in the legacy dataset |
|---|---|
| Finding | A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product. |
CVSS
7.5 HIGH
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
3 metrics
CVSS
7.5 HIGH v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
3 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
NVD | Primary | published |
| CVSS 3.0 | 7.5 | HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
security_alert@emc.com | Secondary | |
| CVSS 2.0 | 5.0 | none | AV:N/AC:L/Au:N/C:N/I:N/A:P |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update January 2021 ↗ | CPU | 2021-Q1 | Oracle Enterprise Manager / Topology Viewer (Spring Framework) (13.3.0.0) |
| Oracle Critical Patch Update July 2020 ↗ | CPU | 2020-Q3 | Oracle Retail Applications / Point of Sale (Spring Framework) (7.1) Oracle Supply Chain / Middle Tier (Spring Framework) (12.1, 12.2) |
| Oracle Critical Patch Update April 2020 ↗ | CPU | 2020-Q2 | Oracle Communications Applications / Core (Spring Framework) (8.0.0, 8.1.0, 8.1.1) Oracle Communications Applications / Core (Spring Framework) (8.0.0, 8.1.0, 8.1.1) Oracle Communications Applications / IDIH Visualization (Spring Framework) (8.0.0, 8.1.0, 8.2.0, 8.2.1) Oracle Fusion Middleware / LDAP Gateway (Spring Framework) (9.0) |
| Oracle Critical Patch Update January 2020 ↗ | CPU | 2020-Q1 | Oracle Communications Applications / Security (Spring Framework) (7.3, 7.4) Oracle Health Sciences Applications / Core (Spring Framework) (3.0) Oracle Systems / Software (Spring Framework) (8.5) |
| Oracle Critical Patch Update October 2019 ↗ | CPU | 2019-Q4 | Oracle Fusion Middleware / 3rd Party (Spring Framework) (12.3.2.1.0) Oracle Retail Applications / RIB Kernal (Spring Framework) (15.0, 16.0) |
| Oracle Critical Patch Update July 2019 ↗ | CPU | 2019-Q3 | Oracle Communications Applications / Security (Spring Framework) (6.1) Oracle Construction and Engineering Suite / Admin (Spring Framework) (15.2, 16.2, 17.12, 18.8) Oracle Construction and Engineering Suite / Admin (Spring Framework) (18.8) Oracle Financial Services Applications / Core (Spring Framework) (12.0.1, 12.0.3, 12.1.0) Oracle Financial Services Applications / Infrastructure (Spring Framework) (8.0.2-8.0.8) Oracle Fusion Middleware / Advanced UI (Spring Framework) (12.2.1.3.0) Oracle Fusion Middleware / Other Issues (Spring Framework) (3.2.0) Oracle Fusion Middleware / Sample apps (Spring Framework) (10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0) Oracle Insurance Applications / Core (Spring Framework) (10.0, 10.1, 10.2, 11.0) Oracle Insurance Applications / Core (Spring Framework) (10.0, 10.1, 10.2, 11.0) Oracle Insurance Applications / Core (Spring Framework) (9.7, 10.0, 10.1, 10.2) Oracle MySQL / Monitoring: General (Spring Framework) (4.0.9 and prior, 8.0.14 and prior) Oracle Retail Applications / Operations & Maintenance (Spring Framework) (15.0) Oracle Retail Applications / PeopleSoft Integration Bugs (Spring Framework) (14.0, 14.1, 15.0, 16.0) Oracle Supply Chain Products Suite / Security (Spring Framework) (9.3.3, 9.3.4, 9.3.5, 9.3.6) |
| Oracle Critical Patch Update April 2019 ↗ | CPU | 2019-Q2 | Oracle Retail Applications / Security (Spring Framework) (12.0, 13.0, 13.1, 13.2, 14.0, 14.1) Oracle Retail Applications / System Administration (Spring Framework) (5.1, 5.2, 15.0, 16.0) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Communications Applications | Core (Spring Framework) | 8.0.0, 8.1.0, 8.1.1 | 8.0.0 · 8.1.0 · 8.1.1 |
| Oracle Communications Applications | IDIH Visualization (Spring Framework) | 8.0.0, 8.1.0, 8.2.0, 8.2.1 | 8.0.0 · 8.1.0 · 8.2.0 · 8.2.1 |
| Oracle Communications Applications | Security (Spring Framework) | 6.1 | 6.1 · 7.3 · 7.4 |
| Oracle Construction and Engineering Suite | Admin (Spring Framework) | 15.2, 16.2, 17.12, 18.8 | 15.2 · 16.2 · 17.12 · 18.8 |
| Oracle Enterprise Manager | Topology Viewer (Spring Framework) | 13.3.0.0 | 13.3.0.0 |
| Oracle Financial Services Applications | Core (Spring Framework) | 12.0.1, 12.0.3, 12.1.0 | 12.0.1 · 12.0.3 · 12.1.0 |
| Oracle Financial Services Applications | Infrastructure (Spring Framework) | 8.0.2-8.0.8 | |
| Oracle Fusion Middleware | 3rd Party (Spring Framework) | 12.3.2.1.0 | 12.3.2.1.0 |
| Oracle Fusion Middleware | Advanced UI (Spring Framework) | 12.2.1.3.0 | 12.2.1.3.0 |
| Oracle Fusion Middleware | LDAP Gateway (Spring Framework) | 9.0 | 9.0 |
| Oracle Fusion Middleware | Other Issues (Spring Framework) | 3.2.0 | 3.2.0 |
| Oracle Fusion Middleware | Sample apps (Spring Framework) | 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 | 10.3.6.0.0 · 12.1.3.0.0 · 12.2.1.3.0 |
| Oracle Health Sciences Applications | Core (Spring Framework) | 3.0 | 3.0 |
| Oracle Insurance Applications | Core (Spring Framework) | 9.7, 10.0, 10.1, 10.2 | 9.7 · 10.0 · 10.1 · 10.2 · 11.0 |
| Oracle MySQL | Monitoring: General (Spring Framework) | 4.0.9 and prior, 8.0.14 and prior | |
| Oracle Retail Applications | Operations & Maintenance (Spring Framework) | 15.0 | 15.0 |
| Oracle Retail Applications | PeopleSoft Integration Bugs (Spring Framework) | 14.0, 14.1, 15.0, 16.0 | 14.0 · 14.1 · 15.0 · 16.0 |
| Oracle Retail Applications | Point of Sale (Spring Framework) | 7.1 | 7.1 |
| Oracle Retail Applications | RIB Kernal (Spring Framework) | 15.0, 16.0 | 15.0 · 16.0 |
| Oracle Retail Applications | Security (Spring Framework) | 12.0, 13.0, 13.1, 13.2, 14.0, 14.1 | 12.0 · 13.0 · 13.1 · 13.2 · 14.0 · 14.1 |
| Oracle Retail Applications | System Administration (Spring Framework) | 5.1, 5.2, 15.0, 16.0 | 5.1 · 5.2 · 15.0 · 16.0 |
| Oracle Supply Chain | Middle Tier (Spring Framework) | 12.1, 12.2 | 12.1 · 12.2 |
| Oracle Supply Chain Products Suite | Security (Spring Framework) | 9.3.3, 9.3.4, 9.3.5, 9.3.6 | 9.3.3 · 9.3.4 · 9.3.5 · 9.3.6 |
| Oracle Systems | Software (Spring Framework) | 8.5 | 8.5 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.springframework:spring-core |
5.1.0.RELEASE | 5.1.1.RELEASE |
unbounded |
org.springframework:spring-core |
5.0.0.RELEASE | 5.0.10.RELEASE |
unbounded |
org.springframework:spring-core |
4.2.0.RELEASE | 4.3.20.RELEASE |
unbounded |
Products and versions
41 products, 117 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | debian | debian linux | generic | 9.0 |
| nvd | oracle | agile product lifecycle management | generic | 9.3.3 · 9.3.4 · 9.3.5 · 9.3.6 |
| nvd | oracle | communications brm - elastic charging engine | generic | 11.3 · 12.0 |
| nvd | oracle | communications converged application server - service controller | generic | 6.0 · 6.1 |
| nvd | oracle | communications diameter signaling router | generic | 8.0.0 · 8.1 · 8.2 · 8.2.1 |
| nvd | oracle | communications element manager | generic | 8.1.1 · 8.2.0 · 8.2.1 |
| nvd | oracle | communications online mediation controller | generic | 6.1 |
| nvd | oracle | communications session report manager | generic | 8.0.0 · 8.1.0 · 8.1.1 · 8.2.0 · 8.2.1 |
| nvd | oracle | communications session route manager | generic | 8.0.0 · 8.1.0 · 8.1.1 · 8.2.0 · 8.2.1 |
| nvd | oracle | communications unified inventory management | generic | 7.3 · 7.4.0 |
| nvd | oracle | endeca information discovery integrator | generic | 3.2.0 |
| nvd | oracle | enterprise manager for fusion applications | generic | 13.3.0.0 |
| nvd | oracle | enterprise manager ops center | generic | 12.3.3 |
| nvd | oracle | financial services analytical applications infrastructure | generic | ≥ 8.0.2 and ≤ 8.0.8 |
| nvd | oracle | flexcube private banking | generic | 12.0.1 · 12.0.3 · 12.1.0 |
| nvd | oracle | goldengate application adapters | generic | 12.3.2.1.0 |
| nvd | oracle | healthcare master person index | generic | 3.0 · 4.0.2 |
| nvd | oracle | identity manager connector | generic | 9.0 |
| nvd | oracle | insurance calculation engine | generic | 9.7 · 10.0 · 10.1 · 10.2 |
| nvd | oracle | insurance policy administration j2ee | generic | 10.0 · 10.1 · 10.2 · 10.2.0 · 10.2.4 · 11.0 · 11.1.0 · 11.2.0 |
| nvd | oracle | insurance rules palette | generic | 10.0 · 10.1 · 10.2 · 10.2.0 · 10.2.4 · 11.0 · 11.0.2 · 11.1.0 · 11.2.0 |
| nvd | oracle | mysql enterprise monitor | generic | ≤ 4.0.12 · ≥ 8.0.0 and ≤ 8.0.20 |
| nvd | oracle | primavera analytics | generic | 18.8 |
| nvd | oracle | primavera gateway | generic | 15.2 · 16.2 · 17.12 · 18.8.0 |
| nvd | oracle | rapid planning | generic | 12.1 · 12.2 |
| nvd | oracle | retail advanced inventory planning | generic | 15.0 |
| nvd | oracle | retail assortment planning | generic | 15.0 · 16.0 |
| nvd | oracle | retail clearance optimization engine | generic | 14.0.5 |
| nvd | oracle | retail financial integration | generic | 14.0 · 14.1 · 15.0 · 16.0 |
| nvd | oracle | retail integration bus | generic | 15.0 · 15.0.3 · 16.0 · 16.0.3 |
| nvd | oracle | retail invoice matching | generic | 12.0 · 13.0 · 13.1 · 13.2 · 14.0 · 14.1 |
| nvd | oracle | retail markdown optimization | generic | 13.4.4 |
| nvd | oracle | retail order broker | generic | 5.1 · 5.2 · 15.0 · 16.0 |
| nvd | oracle | retail predictive application server | generic | 14.0.3 · 14.0.3.26 · 14.1.3 · 14.1.3.37 · 15.0.3 · 15.0.3.100 · 16.0 · 16.0.3 |
| nvd | oracle | retail service backbone | generic | 15.0 · 16.0 · 16.0.1 |
| nvd | oracle | retail xstore point of service | generic | 7.1 |
| nvd | oracle | tape library acsls | generic | 8.5 |
| nvd | oracle | webcenter sites | generic | 12.2.1.3.0 |
| nvd | oracle | weblogic server | generic | 10.3.6.0.0 · 12.1.3.0.0 · 12.2.1.3.0 · 12.2.1.4.0 |
| osv | org.springframework | spring-core | generic | ≥ 4.2.0 and ＜ 4.3.20 · ≥ 5.0.0 and ＜ 5.0.10 · ≥ 5.1.0 and ＜ 5.1.1 |
| nvd | vmware | spring framework | generic | ≥ 4.2.0 and ＜ 4.3.20 · ≥ 5.0.0 and ＜ 5.0.10 · 5.1.0 |
Earlier manual review
A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.
## Manual Classification Context **Labels:** HTTP, SYSTEM ADMINISTRATION (SPRING FRAMEWORK), CORE (SPRING FRAMEWORK), OTHER ISSUES (SPRING FRAMEWORK), NO AUTH REMOTE EXPLOIT, LDAP GATEWAY (SPRING FRAMEWORK), IDIH VISUALIZATION (SPRING FRAMEWORK), ADMIN (SPRING FRAMEWORK), POINT OF SALE (SPRING FRAMEWORK), OPERATIONS & MAINTENANCE (SPRING FRAMEWORK), INFRASTRUCTURE (SPRING FRAMEWORK), TOPOLOGY VIEWER (SPRING FRAMEWORK), SECURITY (SPRING FRAMEWORK), RIB KERNAL (SPRING FRAMEWORK), PEOPLESOFT INTEGRATION BUGS (SPRING FRAMEWORK), SOFTWARE (SPRING FRAMEWORK), SAMPLE APPS (SPRING FRAMEWORK), 3RD PARTY (SPRING FRAMEWORK), ADVANCED UI (SPRING FRAMEWORK), MIDDLE TIER (SPRING FRAMEWORK), MONITORING: GENERAL (SPRING FRAMEWORK) **Products:** ORACLE COMMUNICATIONS SESSION ROUTE MANAGER, ORACLE ENTERPRISE MANAGER, ORACLE RAPID PLANNING, ORACLE CONSTRUCTION AND ENGINEERING SUITE, ORACLE COMMUNICATIONS ONLINE MEDIATION CONTROLLER, ORACLE RETAIL FINANCIAL INTEGRATION, ORACLE FINANCIAL SERVICES APPLICATIONS, ENTERPRISE MANAGER FOR FUSION APPLICATIONS, ORACLE MYSQL, ORACLE INSURANCE CALCULATION ENGINE, PRIMAVERA ANALYTICS, ORACLE RETAIL APPLICATIONS, ORACLE INSURANCE POLICY ADMINISTRATION J2EE, ORACLE FINANCIAL SERVICES ANALYTICAL APPLICATIONS INFRASTRUCTURE, ORACLE SUPPLY CHAIN, ORACLE ENDECA INFORMATION DISCOVERY INTEGRATOR, ORACLE HEALTHCARE MASTER PERSON INDEX, ORACLE AGILE PLM, TAPE LIBRARY ACSLS, SPRINGFRAMEWORK, ORACLE WEBCENTER SITES, ORACLE COMMUNICATIONS SESSION REPORT MANAGER, ORACLE INSURANCE APPLICATIONS, ORACLE FLEXCUBE PRIVATE BANKING, ORACLE WEBLOGIC SERVER, ORACLE COMMUNICATIONS DIAMETER SIGNALING ROUTER (DSR), PRIMAVERA GATEWAY, MYSQL ENTERPRISE MONITOR, ORACLE FUSION MIDDLEWARE, ORACLE RETAIL INTEGRATION BUS, ORACLE RETAIL XSTORE POINT OF SERVICE, ORACLE SYSTEMS, IDENTITY MANAGER CONNECTOR, ORACLE COMMUNICATIONS UNIFIED INVENTORY MANAGEMENT, ORACLE RETAIL ORDER BROKER, ORACLE INSURANCE RULES PALETTE, ORACLE RETAIL ADVANCED INVENTORY PLANNING, ORACLE GOLDENGATE APPLICATION ADAPTERS, ORACLE SUPPLY CHAIN PRODUCTS SUITE, ORACLE RETAIL INVOICE MATCHING, ORACLE COMMUNICATIONS APPLICATIONS, ORACLE HEALTH SCIENCES APPLICATIONS
References
Timeline
Timeline
| Published | 2018-10-18 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-10-08 | NVD's own last-modified date for this record. |