Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-aptr-3d7m-cke3
Vulnerability ID VCID-aptr-3d7m-cke3
Aliases CVE-2018-1260
GHSA-rrpm-pj7p-7j9q
Summary
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-267 Privilege Defined With Unsafe Actions
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 9.8 https://access.redhat.com/errata/RHSA-2018:1809
generic_textual CRITICAL https://access.redhat.com/errata/RHSA-2018:1809
cvssv3.1 9.8 https://access.redhat.com/errata/RHSA-2018:2939
generic_textual CRITICAL https://access.redhat.com/errata/RHSA-2018:2939
cvssv3 6.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-1260.json
epss 0.50333 https://api.first.org/data/v1/epss?cve=CVE-2018-1260
epss 0.50333 https://api.first.org/data/v1/epss?cve=CVE-2018-1260
cvssv3.1 9.8 https://github.com/advisories/GHSA-rrpm-pj7p-7j9q
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-rrpm-pj7p-7j9q
generic_textual CRITICAL https://github.com/advisories/GHSA-rrpm-pj7p-7j9q
cvssv3.1 9.8 https://github.com/spring-attic/spring-security-oauth
generic_textual CRITICAL https://github.com/spring-attic/spring-security-oauth
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2018-1260
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2018-1260
cvssv3.1 9.8 https://pivotal.io/security/cve-2018-1260
generic_textual CRITICAL https://pivotal.io/security/cve-2018-1260
cvssv3.1 9.8 https://web.archive.org/web/20200227123539/http://www.securityfocus.com/bid/104158
generic_textual CRITICAL https://web.archive.org/web/20200227123539/http://www.securityfocus.com/bid/104158
Reference id Reference type URL
https://access.redhat.com/errata/RHSA-2018:1809
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-1260.json
https://api.first.org/data/v1/epss?cve=CVE-2018-1260
https://github.com/spring-attic/spring-security-oauth
https://github.com/spring-projects/spring-security-oauth/commit/1c6815ac1b26fb2f079adbe283c43a7fd0885f3
https://github.com/spring-projects/spring-security-oauth/commit/6b1791179c1092553aa0690da22dac4dff2fc58
https://github.com/spring-projects/spring-security-oauth/commit/8e9792c1963f1aeea81ca618785eb8d71d1cd1d
https://github.com/spring-projects/spring-security-oauth/commit/adb1e6d19c681f394c9513799b81b527b0cb007
https://web.archive.org/web/20200227123539/http://www.securityfocus.com/bid/104158
http://www.securityfocus.com/bid/104158
1584376 https://bugzilla.redhat.com/show_bug.cgi?id=1584376
CVE-2018-1260 https://nvd.nist.gov/vuln/detail/CVE-2018-1260
CVE-2018-1260 https://pivotal.io/security/cve-2018-1260
GHSA-rrpm-pj7p-7j9q https://github.com/advisories/GHSA-rrpm-pj7p-7j9q
RHSA-2018:2939 https://access.redhat.com/errata/RHSA-2018:2939
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2018:1809
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2018:2939
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-1260.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/advisories/GHSA-rrpm-pj7p-7j9q
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/spring-attic/spring-security-oauth
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2018-1260
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://pivotal.io/security/cve-2018-1260
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://web.archive.org/web/20200227123539/http://www.securityfocus.com/bid/104158
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.97899
EPSS Score 0.50333
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-10T18:20:04.880600+00:00 ProjectKB MSRImporter Import https://raw.githubusercontent.com/SAP/project-kb/master/MSR2019/dataset/vulas_db_msr2019_release.csv 38.6.0