What’s Vulnerable › Vulnerabilities

CVE-2018-1275

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 57.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-04-11 · updated 2026-06-17
• Weakness: CWE-94

Description

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack. This CVE addresses the partial fix for CVE-2018-1270 in the 4.3.x branch of the Spring Framework.

Affected products

• Oracle Corporation Oracle Application Testing Suite: 12.5.0.3, 13.1.0.1, 13.2.0.1, 13.3.0.1
• Oracle Big Data Discovery: 1.6.0
• Oracle Corporation Oracle Communications Converged Application Server: before 7.0.0.1 — fixed in 7.0.0.1
• Oracle Corporation Communications Diameter Signaling Router (DSR): before 8.3 — fixed in 8.3
• Oracle Communications Performance Intelligence Center: before 10.2.1 — fixed in 10.2.1
• Oracle Communications Services Gatekeeper: before 6.1.0.4.0 — fixed in 6.1.0.4.0
• Oracle Goldengate For Big Data: 12.2.0.1, 12.3.1.1, 12.3.2.1
• Oracle Health Sciences Information Manager: 3.0
• Oracle Healthcare Master Person Index: 3.0, 4.0
• Oracle Insurance Calculation Engine: 10.1.1, 10.2, 10.2.1
• Oracle Insurance Rules Palette: 10.0, 10.1, 10.2, 11.0, 11.1
• Oracle Corporation Primavera Gateway: 15.2, 16.2, 17.12
• Oracle Retail Customer Insights: 15.0, 16.0
• Oracle Retail Open Commerce Platform: 5.3.0, 6.0.0, 6.0.1
• Oracle Retail Order Broker: 5.1, 5.2, 15.0, 16.0
• Oracle Retail Predictive Application Server: 14.0, 14.1, 15.0, 16.0
• Oracle Service Architecture Leveraging Tuxedo: 12.1.3.0.0, 12.2.2.0.0
• Oracle Corporation Tape Library ACSLS: 8.4
• Spring Framework: from 4.3.0 before 4.3.16; from 5.0.0 before 5.0.5 — fixed in 4.3.16, 5.0.5
• Spring Framework: Versions prior to 5.0.5 and 4.3.16

How to fix

Upgrade to a fixed version: Oracle Corporation Oracle Communications Converged Application Server 7.0.0.1; Oracle Corporation Communications Diameter Signaling Router (DSR) 8.3; Oracle Communications Performance Intelligence Center 10.2.1; Oracle Communications Services Gatekeeper 6.1.0.4.0; Spring Framework 4.3.16, 5.0.5. Check the vendor advisory for mitigations.

References

• http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
• http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
• http://www.securityfocus.com/bid/103771
• http://www.securitytracker.com/id/1041301
• https://access.redhat.com/errata/RHSA-2018:1320
• https://access.redhat.com/errata/RHSA-2018:2939
• https://lists.apache.org/thread.html/4ed49b103f64a0cecb38064f26cbf1389afc12124653da2d35166dbe%40%3Cissues.activemq.apache.org%3E
• https://lists.apache.org/thread.html/ab825fcade0b49becfa30235b3d54f4a51bb74ea96b6c9adb5d1378c%40%3Cissues.activemq.apache.org%3E
• https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369%40%3Cissues.activemq.apache.org%3E
• https://pivotal.io/security/cve-2018-1275
• https://www.oracle.com/security-alerts/cpujul2020.html
• https://www.oracle.com/security-alerts/cpuoct2021.html

Get alerted when CVE-2018-1275 or the next vulnerability affects your stack