CVEvulnerability

CVE-2018-1257

6.5 MEDIUM Published 2018-05-11 Modified 2026-10-08 Official page ↗
Status
Modified
Published
2018-05-11
Last modified
2026-10-08
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:N/I:N/A:P

Description

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.

Affected configurations

• vmware spring framework (< 4.3.17) • vmware spring framework (>= 5.0.0 < 5.0.6) • redhat openshift • oracle agile product lifecycle management 9.3.3 • oracle agile product lifecycle management 9.3.4 • oracle agile product lifecycle management 9.3.5 • oracle agile product lifecycle management 9.3.6 • oracle application testing suite 12.5.0.3 • oracle application testing suite 13.1.0.1 • oracle application testing suite 13.2.0.1 • oracle application testing suite 13.3.0.1 • oracle big data discovery 1.6.0 • oracle communications converged application server (< 7.0.0.1) • oracle communications diameter signaling router (< 8.3) • oracle communications performance intelligence center (< 10.2.1) • oracle communications services gatekeeper (< 6.1.0.4.0) • oracle communications unified inventory management 7.3.2 • oracle communications unified inventory management 7.3.4 • oracle communications unified inventory management 7.3.5 • oracle communications unified inventory management 7.4.0 • oracle endeca information discovery integrator 3.1.0 • oracle endeca information discovery integrator 3.2.0 • oracle enterprise manager base platform 12.1.0.5.0 • oracle enterprise manager base platform 13.2.0.0.0 • oracle enterprise manager base platform 13.3.0.0.0 • oracle enterprise manager for mysql database 13.2 • oracle enterprise manager ops center 12.3.3 • oracle flexcube private banking 2.0.0.0 • oracle flexcube private banking 2.2.0.1 • oracle flexcube private banking 12.0.1.0 • oracle flexcube private banking 12.0.3.0 • oracle flexcube private banking 12.1.0.0 • oracle goldengate for big data 12.2.0.1 • oracle goldengate for big data 12.3.1.1 • oracle goldengate for big data 12.3.2.1 • oracle health sciences information manager 3.0 • oracle healthcare master person index 3.0 • oracle healthcare master person index 4.0 • oracle hospitality guest access 4.2.0 • oracle hospitality guest access 4.2.1 • oracle insurance calculation engine 10.1.1 • oracle insurance calculation engine 10.2 • oracle insurance calculation engine 10.2.1 • oracle insurance rules palette 10.0 • oracle insurance rules palette 10.1 • oracle insurance rules palette 10.2 • oracle insurance rules palette 11.0 • oracle insurance rules palette 11.1 • oracle primavera gateway 15.2 • oracle primavera gateway 16.2 • oracle primavera gateway 17.12 • oracle retail customer insights 15.0 • oracle retail customer insights 16.0 • oracle retail open commerce platform 5.3.0 • oracle retail open commerce platform 6.0.0 • oracle retail open commerce platform 6.0.1 • oracle retail order broker 5.1 • oracle retail order broker 5.2 • oracle retail order broker 15.0 • oracle retail order broker 16.0 … and 11 more

References