CVE-2018-1272

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-04-06 · updated 2026-06-17

Description

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.

Affected products

Oracle Corporation Oracle Application Testing Suite: 12.5.0.3, 13.1.0.1, 13.2.0.1, 13.3.0.1
Oracle Big Data Discovery: 1.6.0
Oracle Corporation Oracle Communications Converged Application Server: before 7.0.0.1 — fixed in 7.0.0.1
Oracle Corporation Communications Diameter Signaling Router (DSR): before 8.3 — fixed in 8.3
Oracle Communications Performance Intelligence Center: before 10.2.1 — fixed in 10.2.1
Oracle Communications Services Gatekeeper: before 6.1.0.4.0 — fixed in 6.1.0.4.0
Oracle Corporation Enterprise Manager Ops Center: 12.2.2, 12.3.3
Oracle Goldengate For Big Data: 12.2.0.1, 12.3.1.1, 12.3.2.1
Oracle Health Sciences Information Manager: 3.0
Oracle Healthcare Master Person Index: 3.0, 4.0
Oracle Insurance Calculation Engine: 10.1.1, 10.2, 10.2.1
Oracle Insurance Rules Palette: 10.0, 10.1, 10.2, 11.0, 11.1
Oracle Corporation Primavera Gateway: 15.2, 16.2, 17.12
Oracle Corporation Retail Back Office: 14.0, 14.1
Oracle Corporation Retail Central Office: 14.0, 14.1
Oracle Retail Customer Insights: 15.0, 16.0
Oracle Corporation Oracle Retail Integration Bus: 14.0.1, 14.0.2, 14.0.3, 14.0.4, 14.1.1, 14.1.2 (+7)
Oracle Retail Open Commerce Platform: 5.3.0, 6.0.0, 6.0.1
Oracle Retail Order Broker: 5.1, 5.2, 15.0, 16.0
Oracle Retail Point-Of-Sale: 14.0, 14.1
Oracle Retail Predictive Application Server: 14.0, 14.1, 15.0, 16.0
Oracle Corporation Retail Returns Management: 14.0, 14.1
Oracle Service Architecture Leveraging Tuxedo: 12.1.3.0.0, 12.2.2.0.0
Oracle Corporation Tape Library ACSLS: 8.4
Spring Framework: from 4.3.0 before 4.3.15; from 5.0 before 5.0.5 — fixed in 4.3.15, 5.0.5
Spring Framework: Versions prior to 5.0.5 and 4.3.15

How to fix

Upgrade to a fixed version: Oracle Corporation Oracle Communications Converged Application Server 7.0.0.1; Oracle Corporation Communications Diameter Signaling Router (DSR) 8.3; Oracle Communications Performance Intelligence Center 10.2.1; Oracle Communications Services Gatekeeper 6.1.0.4.0; Spring Framework 4.3.15, 5.0.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-1272 or the next vulnerability affects your stack