CVE-2018-1270

Description

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.

CVSS breakdown

Affected products

• Debian / debian_linux9.0 – 9.0
• oracle / Application Testing Suite12.5.0.3 – 12.5.0.3
• oracle / Application Testing Suite13.1.0.1 – 13.1.0.1
• oracle / Application Testing Suite13.2.0.1 – 13.2.0.1
• oracle / Application Testing Suite13.3.0.1 – 13.3.0.1
• oracle / big_data_discovery1.6.0 – 1.6.0
• oracle / communications_converged_application_server7.0.0.1
• oracle / communications_diameter_signaling_router8.3
• oracle / communications_performance_intelligence_center10.2.1
• oracle / communications_services_gatekeeper6.1.0.4.0
• oracle / enterprise_manager_ops_center12.2.2 – 12.2.2
• oracle / enterprise_manager_ops_center12.3.3 – 12.3.3
• oracle / goldengate_for_big_data12.3.1.1 – 12.3.1.1
• oracle / goldengate_for_big_data12.2.0.1 – 12.2.0.1
• oracle / goldengate_for_big_data12.3.2.1 – 12.3.2.1
• oracle / healthcare_master_person_index3.0 – 3.0
• oracle / healthcare_master_person_index4.0 – 4.0
• oracle / health_sciences_information_manager3.0 – 3.0
• oracle / insurance_calculation_engine10.2 – 10.2
• oracle / insurance_calculation_engine10.1.1 – 10.1.1
• oracle / insurance_calculation_engine10.2.1 – 10.2.1
• oracle / insurance_rules_palette11.0 – 11.0
• oracle / insurance_rules_palette10.0 – 10.0
• oracle / insurance_rules_palette10.1 – 10.1
• oracle / insurance_rules_palette10.2 – 10.2
• oracle / insurance_rules_palette11.1 – 11.1
• oracle / primavera_gateway16.2 – 16.2
• oracle / primavera_gateway15.2 – 15.2
• oracle / primavera_gateway17.12 – 17.12
• oracle / retail_back_office14.0 – 14.0
• oracle / retail_back_office14.1 – 14.1
• oracle / retail_central_office14.0 – 14.0
• oracle / retail_central_office14.1 – 14.1
• oracle / retail_customer_insights16.0 – 16.0
• oracle / retail_customer_insights15.0 – 15.0
• oracle / retail_integration_bus16.0.2 – 16.0.2
• oracle / retail_integration_bus14.0.1 – 14.0.1
• oracle / retail_integration_bus14.0.2 – 14.0.2
• oracle / retail_integration_bus14.0.3 – 14.0.3
• oracle / retail_integration_bus14.0.4 – 14.0.4
• oracle / retail_integration_bus14.1.1 – 14.1.1
• oracle / retail_integration_bus14.1.2 – 14.1.2
• oracle / retail_integration_bus14.1.3 – 14.1.3
• oracle / retail_integration_bus15.0.0.1 – 15.0.0.1
• oracle / retail_integration_bus15.0.1 – 15.0.1
• oracle / retail_integration_bus15.0.2 – 15.0.2
• oracle / retail_integration_bus16.0 – 16.0
• oracle / retail_integration_bus16.0.1 – 16.0.1
• oracle / retail_open_commerce_platform6.0.0 – 6.0.0
• oracle / retail_open_commerce_platform5.3.0 – 5.3.0
• oracle / retail_open_commerce_platform6.0.1 – 6.0.1
• oracle / retail_order_broker15.0 – 15.0
• oracle / retail_order_broker5.1 – 5.1
• oracle / retail_order_broker5.2 – 5.2
• oracle / retail_order_broker16.0 – 16.0
• oracle / retail_point-of-sale14.0 – 14.0
• oracle / retail_point-of-sale14.1 – 14.1
• oracle / retail_predictive_application_server15.0 – 15.0
• oracle / retail_predictive_application_server14.0 – 14.0
• oracle / retail_predictive_application_server14.1 – 14.1
• oracle / retail_predictive_application_server16.0 – 16.0
• oracle / retail_returns_management14.1 – 14.1
• oracle / retail_returns_management14.0 – 14.0
• oracle / retail_xstore_point_of_service7.1 – 7.1
• oracle / service_architecture_leveraging_tuxedo12.1.3.0.0 – 12.1.3.0.0
• oracle / service_architecture_leveraging_tuxedo12.2.2.0.0 – 12.2.2.0.0
• oracle / tape_library_acsls8.4 – 8.4
• RedHat / fuse1.0.0 – 1.0.0
• Spring by Pivotal / Spring FrameworkVersions prior to 5.0.5 and 4.3.15 – Versions prior to 5.0.5 and 4.3.15
• VMware / Spring Framework4.3.16

References

• VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2018:2939
• EXPLOIThttps://www.exploit-db.com/exploits/44796/
• MISChttp://www.securityfocus.com/bid/103696
• MAILING_LISThttps://lists.apache.org/thread.html/4ed49b103f64a0cecb38064f26cbf1389afc12124653da2d35166dbe%40%3Cissues.activemq.apache.org%3E
• MAILING_LISThttps://lists.apache.org/thread.html/ab825fcade0b49becfa30235b3d54f4a51bb74ea96b6c9adb5d1378c%40%3Cissues.activemq.apache.org%3E
• MAILING_LISThttps://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369%40%3Cissues.activemq.apache.org%3E
• MAILING_LISThttps://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1%40%3Cissues.activemq.apache.org%3E
• VENDOR_ADVISORYhttp://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
• VENDOR_ADVISORYhttp://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujul2020.html
• VENDOR_ADVISORYhttps://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
• VENDOR_ADVISORYhttps://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
• MISChttps://pivotal.io/security/cve-2018-1270
• MAILING_LISThttps://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E
• MAILING_LISThttps://lists.debian.org/debian-lts-announce/2021/04/msg00022.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuoct2021.html