GitHub Advisoryadvisory · Maven
GHSA-cxrj-66c5-9fmh Spring Framework when used in combination with any versions of Spring Security contains an authorization bypass
HIGH
Official page ↗
- Aliases
- CVE-2018-1258
- Ecosystem
- Maven
- Packages
- org.springframework:spring-core
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-863
- Reviewed
- 2020-06-16
Affected packages
• Maven org.springframework:spring-core: >= 5.0.5.RELEASE, < 5.0.6.RELEASE → fixed in 5.0.6.RELEASE
Description
Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.
Related
Alias · CVE (1)
- CVE-2018-1258 Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using… vulnerability
Weakness · CWE (1)
- CWE-863 Incorrect Authorization weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-1258 advisory
- https://github.com/spring-projects/spring-framework/commit/7b8fa90d96aaf751a3256fa755d5f17e081c20f1 web
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html web
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html web
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html web
- https://www.oracle.com/security-alerts/cpuoct2021.html web
- https://www.oracle.com/security-alerts/cpujul2020.html web
- https://www.oracle.com/security-alerts/cpujan2021.html web
- https://www.oracle.com/security-alerts/cpujan2020.html web
- https://www.oracle.com/security-alerts/cpuapr2020.html web
- https://web.archive.org/web/20200807033751/http://www.securitytracker.com/id/1041896 web
- https://web.archive.org/web/20200807025819/http://www.securitytracker.com/id/1041888 web
- https://web.archive.org/web/20200227032934/http://www.securityfocus.com/bid/104222 web
- https://security.netapp.com/advisory/ntap-20181018-0002 web
- https://pivotal.io/security/cve-2018-1258 web
- https://github.com/spring-projects/spring-framework package
- https://github.com/advisories/GHSA-cxrj-66c5-9fmh advisory
- https://access.redhat.com/errata/RHSA-2019:2413 web
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html web
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html web