Orta CVSS 6.5

CVE-2018-1257: Spring Framework: güvenlik açığı

Yayın: 11 Mayıs 2018 23:29 · Güncelleme: 6 Kasım 2026 09:45

Açıklama (NVD)

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.

Özet bilgiler

Ürün: Vmware Spring Framework
CVSS v3.1: 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS: %3,02 (yüzdelik 87)
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
vmware-spring-framework	—	—	4.3.17
vmware-spring-framework	5.0.0	—	5.0.6
redhat-openshift	—	—	—
oracle-agile-product-lifecycle-management	9.3.3	9.3.3	—
oracle-agile-product-lifecycle-management	9.3.4	9.3.4	—
oracle-agile-product-lifecycle-management	9.3.5	9.3.5	—
oracle-agile-product-lifecycle-management	9.3.6	9.3.6	—
oracle-application-testing-suite	12.5.0.3	12.5.0.3	—
oracle-application-testing-suite	13.1.0.1	13.1.0.1	—
oracle-application-testing-suite	13.2.0.1	13.2.0.1	—
oracle-application-testing-suite	13.3.0.1	13.3.0.1	—
oracle-big-data-discovery	1.6.0	1.6.0	—
oracle-communications-converged-application-server	—	—	7.0.0.1
oracle-communications-diameter-signaling-router	—	—	8.3
oracle-communications-performance-intelligence-center	—	—	10.2.1
oracle-communications-services-gatekeeper	—	—	6.1.0.4.0
oracle-communications-unified-inventory-management	7.3.2	7.3.2	—
oracle-communications-unified-inventory-management	7.3.4	7.3.4	—
oracle-communications-unified-inventory-management	7.3.5	7.3.5	—
oracle-communications-unified-inventory-management	7.4.0	7.4.0	—
oracle-endeca-information-discovery-integrator	3.1.0	3.1.0	—
oracle-endeca-information-discovery-integrator	3.2.0	3.2.0	—
oracle-enterprise-manager-base-platform	12.1.0.5.0	12.1.0.5.0	—
oracle-enterprise-manager-base-platform	13.2.0.0.0	13.2.0.0.0	—
oracle-enterprise-manager-base-platform	13.3.0.0.0	13.3.0.0.0	—
oracle-enterprise-manager-for-mysql-database	13.2	13.2	—
oracle-enterprise-manager-ops-center	12.3.3	12.3.3	—
oracle-flexcube-private-banking	2.0.0.0	2.0.0.0	—
oracle-flexcube-private-banking	2.2.0.1	2.2.0.1	—
oracle-flexcube-private-banking	12.0.1.0	12.0.1.0	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları