Strix
26.1K

CVE-2018-1199

MEDIUMCVSS 5.3/10EPSS 2.86%

Last modified

CVE-2018-1199 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. EPSS estimates a 2.86% chance of exploitation in the next 30 days.

Description

Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. In this particular attack, different character encodings used in path parameters allows secured Spring MVC static resource URLs to be bypassed.

Metrics

CVSS 3.1
5.3/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS Probability
2.86%

85.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
VmwareSpring Framework>= 4.3.0, < 4.3.14
VmwareSpring Framework>= 5.0.0, < 5.0.3
VmwareSpring Security>= 4.1.0, < 4.1.5
VmwareSpring Security>= 4.2.0, < 4.2.4
VmwareSpring Security>= 5.0.0, < 5.0.1
RedhatFuse1.0
OracleRapid Planning12.1
OracleRapid Planning12.2
OracleRetail Xstore Point Of Service7.1

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2018-1199?
Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. In this particular attack, different character encodings used in path parameters allows secured Spring MVC static resource URLs to be bypassed.
How severe is CVE-2018-1199?
CVE-2018-1199 has a CVSS score of 5.3/10 (MEDIUM severity). The EPSS model estimates a 2.86% probability of exploitation in the next 30 days.
How do I fix CVE-2018-1199?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2018-1199?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST