What’s Vulnerable › Vulnerabilities

CVE-2018-1258

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-05-11 · updated 2026-08-25
• Weakness: CWE-863

Description

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.

Affected products

• OnCommand Insight: all versions
• NetApp OnCommand Unified Manager for 7-Mode (core package): from 7.3; from 9.4
• NetApp OnCommand Workflow Automation: all versions
• NetApp SnapCenter: all versions
• NetApp Storage Automation Store: all versions
• Oracle Corporation Oracle Agile PLM: 9.3.3, 9.3.4, 9.3.5, 9.3.6
• Oracle Corporation Oracle Application Testing Suite: 10.1, 12.5.0.3, 13.1.0.1, 13.2.0.1, 13.3.0.1
• Oracle Big Data Discovery: 1.6.0
• Oracle Corporation Oracle Communications Converged Application Server: before 7.0.0.1 — fixed in 7.0.0.1
• Oracle Corporation Communications Diameter Signaling Router (DSR): before 8.3 — fixed in 8.3
• Oracle Communications Network Integrity: from 7.3.2 through 7.3.6
• Oracle Communications Performance Intelligence Center: before 10.2.1 — fixed in 10.2.1
• Oracle Communications Services Gatekeeper: before 6.1.0.4.0 — fixed in 6.1.0.4.0
• Oracle Corporation Endeca Information Discovery Integrator: 3.1.0, 3.2.0
• Oracle Enterprise Manager For Mysql Database: 13.2
• Oracle Corporation Enterprise Manager Ops Center: 12.2.2, 12.3.3
• Oracle Corporation Enterprise Repository: 11.1.1.7.0, 12.1.3.0.0
• Oracle Goldengate For Big Data: 12.2.0.1, 12.3.1.1, 12.3.2.1
• Oracle Health Sciences Information Manager: 3.0
• Oracle Healthcare Master Person Index: 3.0, 4.0
• Oracle Corporation Hospitality Guest Access: 4.2.0, 4.2.1
• Oracle Insurance Calculation Engine: 10.1.1, 10.2, 10.2.1
• Oracle Insurance Policy Administration: 10.0, 10.1, 10.2, 11.0
• Oracle Insurance Rules Palette: 10.0, 10.1, 10.2, 11.0, 11.1
• Oracle Corporation MICROS Lucas: 2.9.5
• Oracle Corporation MySQL Enterprise Monitor: through 8.0.2.8191
• Oracle Peoplesoft Enterprise Fin Install: 9.2
• Oracle Retail Assortment Planning: 14.1, 15.0, 16.0
• Oracle Corporation Retail Back Office: 14.0, 14.1
• Oracle Corporation Retail Central Office: 14.0, 14.1

How to fix

Upgrade to a fixed version: Oracle Corporation Oracle Communications Converged Application Server 7.0.0.1; Oracle Corporation Communications Diameter Signaling Router (DSR) 8.3; Oracle Communications Performance Intelligence Center 10.2.1; Oracle Communications Services Gatekeeper 6.1.0.4.0. Check the vendor advisory for mitigations.

References

• http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
• http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
• http://www.securityfocus.com/bid/104222
• http://www.securitytracker.com/id/1041888
• http://www.securitytracker.com/id/1041896
• https://access.redhat.com/errata/RHSA-2019:2413
• https://pivotal.io/security/cve-2018-1258
• https://security.netapp.com/advisory/ntap-20181018-0002/
• https://www.oracle.com/security-alerts/cpuapr2020.html
• https://www.oracle.com/security-alerts/cpujan2020.html
• https://www.oracle.com/security-alerts/cpujan2021.html
• https://www.oracle.com/security-alerts/cpujul2020.html

Get alerted when CVE-2018-1258 or the next vulnerability affects your stack