CVEvulnerability

CVE-2018-1258

8.8 HIGH Published 2018-05-11 Modified 2026-08-25 Official page ↗
Status
Modified
Published
2018-05-11
Last modified
2026-08-25
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
Weaknesses
CWE-863

Description

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.

Affected configurations

• pivotal software spring security • vmware spring framework 5.0.5 • oracle agile product lifecycle management 9.3.3 • oracle agile product lifecycle management 9.3.4 • oracle agile product lifecycle management 9.3.5 • oracle agile product lifecycle management 9.3.6 • oracle application testing suite 10.1 • oracle application testing suite 12.5.0.3 • oracle application testing suite 13.1.0.1 • oracle application testing suite 13.2.0.1 • oracle application testing suite 13.3.0.1 • oracle big data discovery 1.6.0 • oracle communications converged application server (< 7.0.0.1) • oracle communications diameter signaling router (< 8.3) • oracle communications network integrity (>= 7.3.2 <= 7.3.6) • oracle communications performance intelligence center (< 10.2.1) • oracle communications services gatekeeper (< 6.1.0.4.0) • oracle endeca information discovery integrator 3.1.0 • oracle endeca information discovery integrator 3.2.0 • oracle enterprise manager for mysql database 13.2 • oracle enterprise manager ops center 12.2.2 • oracle enterprise manager ops center 12.3.3 • oracle enterprise repository 11.1.1.7.0 • oracle enterprise repository 12.1.3.0.0 • oracle goldengate for big data 12.2.0.1 • oracle goldengate for big data 12.3.1.1 • oracle goldengate for big data 12.3.2.1 • oracle health sciences information manager 3.0 • oracle healthcare master person index 3.0 • oracle healthcare master person index 4.0 • oracle hospitality guest access 4.2.0 • oracle hospitality guest access 4.2.1 • oracle insurance calculation engine 10.1.1 • oracle insurance calculation engine 10.2 • oracle insurance calculation engine 10.2.1 • oracle insurance policy administration 10.0 • oracle insurance policy administration 10.1 • oracle insurance policy administration 10.2 • oracle insurance policy administration 11.0 • oracle insurance rules palette 10.0 • oracle insurance rules palette 10.1 • oracle insurance rules palette 10.2 • oracle insurance rules palette 11.0 • oracle insurance rules palette 11.1 • oracle micros lucas 2.9.5 • oracle mysql enterprise monitor (<= 8.0.2.8191) • oracle peoplesoft enterprise fin install 9.2 • oracle retail assortment planning 14.1 • oracle retail assortment planning 15.0 • oracle retail assortment planning 16.0 • oracle retail back office 14.0 • oracle retail back office 14.1 • oracle retail central office 14.0 • oracle retail central office 14.1 • oracle retail customer insights 15.0 • oracle retail customer insights 16.0 • oracle retail financial integration 13.2 • oracle retail financial integration 14.0 • oracle retail financial integration 14.1 • oracle retail financial integration 15.0 … and 21 more

Related

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References