Strix
26.1K

CVE-2018-15756

HIGHCVSS 7.5/10EPSS 9.51%

Last modified

CVE-2018-15756 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. EPSS estimates a 9.51% chance of exploitation in the next 30 days.

Description

Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.

Metrics

CVSS 3.1
7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Probability
9.51%

94.8th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

VendorProductVersions
VmwareSpring Framework>= 4.2.0, < 4.3.20
VmwareSpring Framework>= 5.0.0, < 5.0.10
VmwareSpring Framework5.1.0
OracleAgile Plm9.3.3
OracleAgile Plm9.3.4
OracleAgile Plm9.3.5
OracleAgile Plm9.3.6
OracleCommunications Brm - Elastic Charging Engine11.3
OracleCommunications Brm - Elastic Charging Engine12.0
OracleCommunications Converged Application Server - Service Controller6.0
OracleCommunications Converged Application Server - Service Controller6.1
OracleCommunications Diameter Signaling Router8.0.0
OracleCommunications Diameter Signaling Router8.1
OracleCommunications Diameter Signaling Router8.2
OracleCommunications Diameter Signaling Router8.2.1
OracleCommunications Element Manager8.1.1
OracleCommunications Element Manager8.2.0
OracleCommunications Element Manager8.2.1
OracleCommunications Online Mediation Controller6.1
OracleCommunications Session Report Manager8.0.0
OracleCommunications Session Report Manager8.1.0
OracleCommunications Session Report Manager8.1.1
OracleCommunications Session Report Manager8.2.0
OracleCommunications Session Report Manager8.2.1
OracleCommunications Session Route Manager8.0.0
OracleCommunications Session Route Manager8.1.0
OracleCommunications Session Route Manager8.1.1
OracleCommunications Session Route Manager8.2.0
OracleCommunications Session Route Manager8.2.1
OracleCommunications Unified Inventory Management7.3
OracleCommunications Unified Inventory Management7.4.0
OracleEndeca Information Discovery Integrator3.2.0
OracleEnterprise Manager For Fusion Applications13.3.0.0
OracleEnterprise Manager Ops Center12.3.3
OracleFinancial Services Analytical Applications Infrastructure>= 8.0.2, <= 8.0.8
OracleFlexcube Private Banking12.0.1
OracleFlexcube Private Banking12.0.3
OracleFlexcube Private Banking12.1.0
OracleGoldengate Application Adapters12.3.2.1.0
OracleHealthcare Master Person Index3.0
OracleHealthcare Master Person Index4.0.2
OracleIdentity Manager Connector9.0
OracleInsurance Calculation Engine9.7
OracleInsurance Calculation Engine10.0
OracleInsurance Calculation Engine10.1
OracleInsurance Calculation Engine10.2
OracleInsurance Policy Administration J2ee10.0
OracleInsurance Policy Administration J2ee10.1
OracleInsurance Policy Administration J2ee10.2
OracleInsurance Policy Administration J2ee10.2.0

Showing 50 of 114 affected configurations. See NVD for the full list.

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2018-15756?
Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.
How severe is CVE-2018-15756?
CVE-2018-15756 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 9.51% probability of exploitation in the next 30 days.
How do I fix CVE-2018-15756?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2018-15756?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST