CVEvulnerability

CVE-2018-1272

7.5 HIGH Published 2018-04-06 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-04-06
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.0 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:P

Description

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.

Affected configurations

• vmware spring framework (>= 4.3.0 < 4.3.15) • vmware spring framework (>= 5.0 < 5.0.5) • oracle application testing suite 12.5.0.3 • oracle application testing suite 13.1.0.1 • oracle application testing suite 13.2.0.1 • oracle application testing suite 13.3.0.1 • oracle big data discovery 1.6.0 • oracle communications converged application server (< 7.0.0.1) • oracle communications diameter signaling router (< 8.3) • oracle communications performance intelligence center (< 10.2.1) • oracle communications services gatekeeper (< 6.1.0.4.0) • oracle enterprise manager ops center 12.2.2 • oracle enterprise manager ops center 12.3.3 • oracle goldengate for big data 12.2.0.1 • oracle goldengate for big data 12.3.1.1 • oracle goldengate for big data 12.3.2.1 • oracle health sciences information manager 3.0 • oracle healthcare master person index 3.0 • oracle healthcare master person index 4.0 • oracle insurance calculation engine 10.1.1 • oracle insurance calculation engine 10.2 • oracle insurance calculation engine 10.2.1 • oracle insurance rules palette 10.0 • oracle insurance rules palette 10.1 • oracle insurance rules palette 10.2 • oracle insurance rules palette 11.0 • oracle insurance rules palette 11.1 • oracle primavera gateway 15.2 • oracle primavera gateway 16.2 • oracle primavera gateway 17.12 • oracle retail back office 14.0 • oracle retail back office 14.1 • oracle retail central office 14.0 • oracle retail central office 14.1 • oracle retail customer insights 15.0 • oracle retail customer insights 16.0 • oracle retail integration bus 14.0.1 • oracle retail integration bus 14.0.2 • oracle retail integration bus 14.0.3 • oracle retail integration bus 14.0.4 • oracle retail integration bus 14.1.1 • oracle retail integration bus 14.1.2 • oracle retail integration bus 14.1.3 • oracle retail integration bus 15.0.0.1 • oracle retail integration bus 15.0.1 • oracle retail integration bus 15.0.2 • oracle retail integration bus 16.0 • oracle retail integration bus 16.0.1 • oracle retail integration bus 16.0.2 • oracle retail open commerce platform 5.3.0 • oracle retail open commerce platform 6.0.0 • oracle retail open commerce platform 6.0.1 • oracle retail order broker 5.1 • oracle retail order broker 5.2 • oracle retail order broker 15.0 • oracle retail order broker 16.0 • oracle retail point-of-sale 14.0 • oracle retail point-of-sale 14.1 • oracle retail predictive application server 14.0 • oracle retail predictive application server 14.1 … and 7 more

References