CVE-2018-1272

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.

• http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlPatch, Third Party Advisory
• http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlPatch, Third Party Advisory
• http://www.securityfocus.com/bid/103697Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2018:1320Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:2669Third Party Advisory
• https://pivotal.io/security/cve-2018-1272Vendor Advisory
• https://www.oracle.com/security-alerts/cpujul2020.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
• https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlPatch, Third Party Advisory
• https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlPatch, Third Party Advisory
• http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlPatch, Third Party Advisory
• http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlPatch, Third Party Advisory
• http://www.securityfocus.com/bid/103697Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2018:1320Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:2669Third Party Advisory
• https://pivotal.io/security/cve-2018-1272Vendor Advisory
• https://www.oracle.com/security-alerts/cpujul2020.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
• https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlPatch, Third Party Advisory
• https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlPatch, Third Party Advisory

Published

Apr 6, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-12711An XSS issue was discovered in the language switcher module …
• CVE-2018-12712An issue was discovered in Joomla! 2.5.0 through 3.8.8 befor…
• CVE-2018-12713GIMP through 2.10.2 makes g_get_tmp_dir calls to establish t…9.1
• CVE-2018-12714An issue was discovered in the Linux kernel through 4.17.2. …9.8
• CVE-2018-12715DIGISOL DG-HR3400 devices have XSS via a modified SSID when …6.1
• CVE-2018-12716The API service on Google Home and Chromecast devices before…
• CVE-2018-1273Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 …9.8
• CVE-2018-12735SAJ Solar Inverter allows remote attackers to obtain potenti…
• CVE-2018-12739In BEESCMS 4.0, CSRF allows administrators to be added arbit…
• CVE-2018-1274Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5,…7.5
• CVE-2018-1275Spring Framework, versions 5.0 prior to 5.0.5 and versions 4…9.8
• CVE-2018-12754Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.01…