Strix
26.1K

CVE-2018-1257

MEDIUMCVSS 6.5/10EPSS 3.28%

Last modified

CVE-2018-1257 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.. EPSS estimates a 3.28% chance of exploitation in the next 30 days.

Description

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.

Metrics

CVSS 3.1
6.5/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Probability
3.28%

86.9th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

VendorProductVersions
VmwareSpring Framework< 4.3.17
VmwareSpring Framework>= 5.0.0, < 5.0.6
RedhatOpenshiftAll versions
OracleAgile Product Lifecycle Management9.3.3
OracleAgile Product Lifecycle Management9.3.4
OracleAgile Product Lifecycle Management9.3.5
OracleAgile Product Lifecycle Management9.3.6
OracleApplication Testing Suite12.5.0.3
OracleApplication Testing Suite13.1.0.1
OracleApplication Testing Suite13.2.0.1
OracleApplication Testing Suite13.3.0.1
OracleBig Data Discovery1.6.0
OracleCommunications Converged Application Server< 7.0.0.1
OracleCommunications Diameter Signaling Router< 8.3
OracleCommunications Performance Intelligence Center< 10.2.1
OracleCommunications Services Gatekeeper< 6.1.0.4.0
OracleCommunications Unified Inventory Management7.3.2
OracleCommunications Unified Inventory Management7.3.4
OracleCommunications Unified Inventory Management7.3.5
OracleCommunications Unified Inventory Management7.4.0
OracleEndeca Information Discovery Integrator3.1.0
OracleEndeca Information Discovery Integrator3.2.0
OracleEnterprise Manager Base Platform12.1.0.5.0
OracleEnterprise Manager Base Platform13.2.0.0.0
OracleEnterprise Manager Base Platform13.3.0.0.0
OracleEnterprise Manager For Mysql Database13.2
OracleEnterprise Manager Ops Center12.3.3
OracleFlexcube Private Banking2.0.0.0
OracleFlexcube Private Banking2.2.0.1
OracleFlexcube Private Banking12.0.1.0
OracleFlexcube Private Banking12.0.3.0
OracleFlexcube Private Banking12.1.0.0
OracleGoldengate For Big Data12.2.0.1
OracleGoldengate For Big Data12.3.1.1
OracleGoldengate For Big Data12.3.2.1
OracleHealth Sciences Information Manager3.0
OracleHealthcare Master Person Index3.0
OracleHealthcare Master Person Index4.0
OracleHospitality Guest Access4.2.0
OracleHospitality Guest Access4.2.1
OracleInsurance Calculation Engine10.1.1
OracleInsurance Calculation Engine10.2
OracleInsurance Calculation Engine10.2.1
OracleInsurance Rules Palette10.0
OracleInsurance Rules Palette10.1
OracleInsurance Rules Palette10.2
OracleInsurance Rules Palette11.0
OracleInsurance Rules Palette11.1
OraclePrimavera Gateway15.2
OraclePrimavera Gateway16.2

Showing 50 of 71 affected configurations. See NVD for the full list.

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2018-1257?
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.
How severe is CVE-2018-1257?
CVE-2018-1257 has a CVSS score of 6.5/10 (MEDIUM severity). The EPSS model estimates a 3.28% probability of exploitation in the next 30 days.
How do I fix CVE-2018-1257?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2018

View all 2018CVEs →

Are you affected by CVE-2018-1257?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST