What’s Vulnerable › Vulnerabilities

CVE-2018-1257

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-05-11 · updated 2026-10-08

Description

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.

Affected products

• Oracle Corporation Oracle Agile PLM: 9.3.3, 9.3.4, 9.3.5, 9.3.6
• Oracle Corporation Oracle Application Testing Suite: 12.5.0.3, 13.1.0.1, 13.2.0.1, 13.3.0.1
• Oracle Big Data Discovery: 1.6.0
• Oracle Corporation Oracle Communications Converged Application Server: before 7.0.0.1 — fixed in 7.0.0.1
• Oracle Corporation Communications Diameter Signaling Router (DSR): before 8.3 — fixed in 8.3
• Oracle Communications Performance Intelligence Center: before 10.2.1 — fixed in 10.2.1
• Oracle Communications Services Gatekeeper: before 6.1.0.4.0 — fixed in 6.1.0.4.0
• Oracle Corporation Oracle Communications Unified Inventory Management: 7.3.2, 7.3.4, 7.3.5, 7.4.0
• Oracle Corporation Endeca Information Discovery Integrator: 3.1.0, 3.2.0
• Oracle Corporation Enterprise Manager Base Platform: 12.1.0.5.0, 13.2.0.0.0, 13.3.0.0.0
• Oracle Enterprise Manager For Mysql Database: 13.2
• Oracle Corporation Enterprise Manager Ops Center: 12.3.3
• Oracle Corporation FLEXCUBE Private Banking: 2.0.0.0, 2.2.0.1, 12.0.1.0, 12.0.3.0, 12.1.0.0
• Oracle Goldengate For Big Data: 12.2.0.1, 12.3.1.1, 12.3.2.1
• Oracle Health Sciences Information Manager: 3.0
• Oracle Healthcare Master Person Index: 3.0, 4.0
• Oracle Corporation Hospitality Guest Access: 4.2.0, 4.2.1
• Oracle Insurance Calculation Engine: 10.1.1, 10.2, 10.2.1
• Oracle Insurance Rules Palette: 10.0, 10.1, 10.2, 11.0, 11.1
• Oracle Corporation Primavera Gateway: 15.2, 16.2, 17.12
• Oracle Retail Customer Insights: 15.0, 16.0
• Oracle Retail Open Commerce Platform: 5.3.0, 6.0.0, 6.0.1
• Oracle Retail Order Broker: 5.1, 5.2, 15.0, 16.0
• Oracle Retail Predictive Application Server: 14.0, 14.1, 15.0, 16.0
• Oracle Service Architecture Leveraging Tuxedo: 12.1.3.0.0, 12.2.2.0.0
• Oracle Corporation Tape Library ACSLS: 8.4
• Oracle Corporation Oracle Utilities Network Management System: 1.12.0.3
• Oracle WebLogic Server: 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0
• Openshift: all versions
• Spring Framework: before 4.3.17; from 5.0.0 before 5.0.6 — fixed in 4.3.17, 5.0.6

How to fix

Upgrade to a fixed version: Oracle Corporation Oracle Communications Converged Application Server 7.0.0.1; Oracle Corporation Communications Diameter Signaling Router (DSR) 8.3; Oracle Communications Performance Intelligence Center 10.2.1; Oracle Communications Services Gatekeeper 6.1.0.4.0; Spring Framework 4.3.17, 5.0.6. Check the vendor advisory for mitigations.

References

• http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
• http://www.securityfocus.com/bid/104260
• https://access.redhat.com/errata/RHSA-2018:1809
• https://access.redhat.com/errata/RHSA-2018:3768
• https://pivotal.io/security/cve-2018-1257
• https://www.oracle.com/security-alerts/cpujan2020.html
• https://www.oracle.com/security-alerts/cpujul2020.html
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
• https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
• https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
• http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Get alerted when CVE-2018-1257 or the next vulnerability affects your stack