What’s Vulnerable › Vulnerabilities

CVE-2018-1271

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 34.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-04-06 · updated 2026-06-17
• Weakness: CWE-22

Description

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.

Affected products

• Oracle Corporation Oracle Application Testing Suite: 12.5.0.3, 13.1.0.1, 13.2.0.1, 13.3.0.1
• Oracle Big Data Discovery: 1.6.0
• Oracle Corporation Oracle Communications Converged Application Server: before 7.0.0.1 — fixed in 7.0.0.1
• Oracle Corporation Communications Diameter Signaling Router (DSR): before 8.3 — fixed in 8.3
• Oracle Communications Performance Intelligence Center: before 10.2.1 — fixed in 10.2.1
• Oracle Corporation Communications Policy Management: 12.5.0
• Oracle Communications Services Gatekeeper: before 6.1.0.4.0 — fixed in 6.1.0.4.0
• Oracle Corporation Enterprise Manager Ops Center: 12.2.2, 12.3.3
• Oracle Goldengate For Big Data: 12.2.0.1, 12.3.1.1, 12.3.2.1
• Oracle Health Sciences Information Manager: 3.0
• Oracle Healthcare Master Person Index: 3.0, 4.0
• Oracle Insurance Calculation Engine: from 11.0.0 through 11.3.1; 10.1.1, 10.2, 10.2.1
• Oracle Insurance Rules Palette: 10.0, 10.1, 10.2, 11.0, 11.1
• Oracle Corporation Primavera Gateway: 15.2, 16.2, 17.12
• Oracle Corporation Rapid Planning: 12.1, 12.2
• Oracle Corporation Retail Back Office: 14.0, 14.1
• Oracle Corporation Retail Central Office: 14.0, 14.1
• Oracle Retail Customer Insights: 15.0, 16.0
• Oracle Corporation Oracle Retail Integration Bus: 14.0.1, 14.0.2, 14.0.3, 14.0.4, 14.1.1, 14.1.2 (+7)
• Oracle Retail Open Commerce Platform: 5.3.0, 6.0.0, 6.0.1
• Oracle Retail Order Broker: 5.1, 5.2, 15.0, 16.0
• Oracle Retail Point-Of-Sale: 14.0, 14.1
• Oracle Retail Predictive Application Server: 14.0, 14.1, 15.0, 16.0
• Oracle Corporation Retail Returns Management: 14.0, 14.1
• Oracle Corporation Retail Xstore Point of Service: 7.1
• Oracle Service Architecture Leveraging Tuxedo: 12.1.3.0.0, 12.2.2.0.0
• Oracle Corporation Tape Library ACSLS: 8.4
• Spring Framework: from 4.3.0 before 4.3.15; from 5.0.0 before 5.0.5 — fixed in 4.3.15, 5.0.5
• Spring Framework: Versions prior to 5.0.5 and 4.3.15

How to fix

Upgrade to a fixed version: Oracle Corporation Oracle Communications Converged Application Server 7.0.0.1; Oracle Corporation Communications Diameter Signaling Router (DSR) 8.3; Oracle Communications Performance Intelligence Center 10.2.1; Oracle Communications Services Gatekeeper 6.1.0.4.0; Spring Framework 4.3.15, 5.0.5. Check the vendor advisory for mitigations.

References

• http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
• http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
• http://www.securityfocus.com/bid/103699
• https://access.redhat.com/errata/RHSA-2018:1320
• https://access.redhat.com/errata/RHSA-2018:2669
• https://access.redhat.com/errata/RHSA-2018:2939
• https://pivotal.io/security/cve-2018-1271
• https://www.oracle.com/security-alerts/cpujul2020.html
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
• https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
• http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Get alerted when CVE-2018-1271 or the next vulnerability affects your stack