Kritik CVSS 9.8
CVE-2018-1270: Spring Framework: kod enjeksiyonu
Açıklama (NVD)
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.
Özet bilgiler
- Ürün
- Vmware Spring Framework
- CVSS v3.1
- 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- %77,48 (yüzdelik 100)
- CWE
- CWE-94
- Yama
- Mevcut
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| vmware-spring-framework | — | — | 4.3.16 |
| vmware-spring-framework | 5.0.0 | — | 5.0.5 |
| oracle-application-testing-suite | 12.5.0.3 | 12.5.0.3 | — |
| oracle-application-testing-suite | 13.1.0.1 | 13.1.0.1 | — |
| oracle-application-testing-suite | 13.2.0.1 | 13.2.0.1 | — |
| oracle-application-testing-suite | 13.3.0.1 | 13.3.0.1 | — |
| oracle-big-data-discovery | 1.6.0 | 1.6.0 | — |
| oracle-communications-converged-application-server | — | — | 7.0.0.1 |
| oracle-communications-diameter-signaling-router | — | — | 8.3 |
| oracle-communications-performance-intelligence-center | — | — | 10.2.1 |
| oracle-communications-services-gatekeeper | — | — | 6.1.0.4.0 |
| oracle-enterprise-manager-ops-center | 12.2.2 | 12.2.2 | — |
| oracle-enterprise-manager-ops-center | 12.3.3 | 12.3.3 | — |
| oracle-goldengate-for-big-data | 12.2.0.1 | 12.2.0.1 | — |
| oracle-goldengate-for-big-data | 12.3.1.1 | 12.3.1.1 | — |
| oracle-goldengate-for-big-data | 12.3.2.1 | 12.3.2.1 | — |
| oracle-health-sciences-information-manager | 3.0 | 3.0 | — |
| oracle-healthcare-master-person-index | 3.0 | 3.0 | — |
| oracle-healthcare-master-person-index | 4.0 | 4.0 | — |
| oracle-insurance-calculation-engine | 10.1.1 | 10.1.1 | — |
| oracle-insurance-calculation-engine | 10.2 | 10.2 | — |
| oracle-insurance-calculation-engine | 10.2.1 | 10.2.1 | — |
| oracle-insurance-rules-palette | 10.0 | 10.0 | — |
| oracle-insurance-rules-palette | 10.1 | 10.1 | — |
| oracle-insurance-rules-palette | 10.2 | 10.2 | — |
| oracle-insurance-rules-palette | 11.0 | 11.0 | — |
| oracle-insurance-rules-palette | 11.1 | 11.1 | — |
| oracle-primavera-gateway | 15.2 | 15.2 | — |
| oracle-primavera-gateway | 16.2 | 16.2 | — |
| oracle-primavera-gateway | 17.12 | 17.12 | — |
Kaynaklar
- NVD kaydı
- www.oracle.com
- www.oracle.com
- www.securityfocus.com
- access.redhat.com
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.debian.org
- pivotal.io
- www.exploit-db.com
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.securityfocus.com
- access.redhat.com
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- CWE-94