Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-p5hg-3xm3-gcjg
Advisory ID github_osv/GHSA-p5hg-3xm3-gcjg
Aliases CVE-2018-1270
Summary Spring Framework allows applications to expose STOMP over WebSocket endpoints Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.
Status Published
Exploitability 0.5
Weighted Severity 8.8
Risk 4.4
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (2)
CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-358 Improperly Implemented Security Check for Standard
System Score Found at
cvssv3 9.8 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-p5hg-3xm3-gcjg/GHSA-p5hg-3xm3-gcjg.json
generic_textual CRITICAL
Reference id Reference type URL
https://github.com/spring-projects/spring-framework
https://github.com/spring-projects/spring-framework/commit/0009806debb578e884f6dc98bd1f2dc668020021
https://github.com/spring-projects/spring-framework/commit/e0de9126ed8cf25cf141d3e66420da94e350708a
https://lists.apache.org/thread.html/4ed49b103f64a0cecb38064f26cbf1389afc12124653da2d35166dbe@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/ab825fcade0b49becfa30235b3d54f4a51bb74ea96b6c9adb5d1378c@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html
https://nvd.nist.gov/vuln/detail/CVE-2018-1270
https://pivotal.io/security/cve-2018-1270
https://web.archive.org/web/20200227125035/https://www.securityfocus.com/bid/103696
https://www.exploit-db.com/exploits/44796
cpujan2019-5072801.html Other https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
cpujul2018-4258247.html Other http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
cpujul2019-5072835.html Other https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
cpujul2020.html Other https://www.oracle.com/security-alerts/cpujul2020.html
cpuoct2018-4428296.html Other http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
cpuoct2021.html Other https://www.oracle.com/security-alerts/cpuoct2021.html
RHSA-2018:2939 Advisory https://access.redhat.com/errata/RHSA-2018:2939
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-p5hg-3xm3-gcjg/GHSA-p5hg-3xm3-gcjg.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

There are no SSVC decisions available.