CVE-2018-1258

spring-security-core: Unauthorized Access with Spring Security Method Security

Severity Score

8.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.

La versión 5.0.5 de Spring Framework, cuando se utiliza en combinación con cualquier versión de Spring Security, contiene un omisión de autorización cuando se utiliza la seguridad del método. Un usuario malicioso no autorizado puede obtener acceso no autorizado a métodos que deben ser restringidos.

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2017-12-06 CVE Reserved
2018-05-11 CVE Published
2024-07-04 EPSS Updated
2024-09-17 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-287: Improper Authentication
CWE-863: Incorrect Authorization

CAPEC

References (18)

URL	Tag	Source
http://www.securityfocus.com/bid/104222	Third Party Advisory
http://www.securitytracker.com/id/1041888	Third Party Advisory
http://www.securitytracker.com/id/1041896	Third Party Advisory
https://security.netapp.com/advisory/ntap-20181018-0002	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html	2022-04-11
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html	2022-04-11
https://access.redhat.com/errata/RHSA-2019:2413	2022-04-11
https://www.oracle.com/security-alerts/cpuapr2020.html	2022-04-11
https://www.oracle.com/security-alerts/cpujan2020.html	2022-04-11
https://www.oracle.com/security-alerts/cpujan2021.html	2022-04-11
https://www.oracle.com/security-alerts/cpujul2020.html	2022-04-11
https://www.oracle.com/security-alerts/cpuoct2021.html	2022-04-11
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html	2022-04-11
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html	2022-04-11
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html	2022-04-11

URL	Date	SRC
https://pivotal.io/security/cve-2018-1258	2022-04-11
https://access.redhat.com/security/cve/CVE-2018-1258	2019-08-08
https://bugzilla.redhat.com/show_bug.cgi?id=1578582	2019-08-08

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Pivotal Software Search vendor "Pivotal Software"		Spring Security Search vendor "Pivotal Software" for product "Spring Security"				*		-		Affected
Vmware Search vendor "Vmware"		Spring Framework Search vendor "Vmware" for product "Spring Framework"				5.0.5 Search vendor "Vmware" for product "Spring Framework" and version "5.0.5"		-		Affected
Oracle Search vendor "Oracle"		Agile Plm Search vendor "Oracle" for product "Agile Plm"				9.3.3 Search vendor "Oracle" for product "Agile Plm" and version "9.3.3"		-		Affected
Oracle Search vendor "Oracle"		Agile Plm Search vendor "Oracle" for product "Agile Plm"				9.3.4 Search vendor "Oracle" for product "Agile Plm" and version "9.3.4"		-		Affected
Oracle Search vendor "Oracle"		Agile Plm Search vendor "Oracle" for product "Agile Plm"				9.3.5 Search vendor "Oracle" for product "Agile Plm" and version "9.3.5"		-		Affected
Oracle Search vendor "Oracle"		Agile Plm Search vendor "Oracle" for product "Agile Plm"				9.3.6 Search vendor "Oracle" for product "Agile Plm" and version "9.3.6"		-		Affected
Oracle Search vendor "Oracle"		Application Testing Suite Search vendor "Oracle" for product "Application Testing Suite"				10.1 Search vendor "Oracle" for product "Application Testing Suite" and version "10.1"		-		Affected
Oracle Search vendor "Oracle"		Application Testing Suite Search vendor "Oracle" for product "Application Testing Suite"				12.5.0.3 Search vendor "Oracle" for product "Application Testing Suite" and version "12.5.0.3"		-		Affected
Oracle Search vendor "Oracle"		Application Testing Suite Search vendor "Oracle" for product "Application Testing Suite"				13.1.0.1 Search vendor "Oracle" for product "Application Testing Suite" and version "13.1.0.1"		-		Affected
Oracle Search vendor "Oracle"		Application Testing Suite Search vendor "Oracle" for product "Application Testing Suite"				13.2.0.1 Search vendor "Oracle" for product "Application Testing Suite" and version "13.2.0.1"		-		Affected
Oracle Search vendor "Oracle"		Application Testing Suite Search vendor "Oracle" for product "Application Testing Suite"				13.3.0.1 Search vendor "Oracle" for product "Application Testing Suite" and version "13.3.0.1"		-		Affected
Oracle Search vendor "Oracle"		Big Data Discovery Search vendor "Oracle" for product "Big Data Discovery"				1.6.0 Search vendor "Oracle" for product "Big Data Discovery" and version "1.6.0"		-		Affected
Oracle Search vendor "Oracle"		Communications Converged Application Server Search vendor "Oracle" for product "Communications Converged Application Server"				< 7.0.0.1 Search vendor "Oracle" for product "Communications Converged Application Server" and version " < 7.0.0.1"		-		Affected
Oracle Search vendor "Oracle"		Communications Diameter Signaling Router Search vendor "Oracle" for product "Communications Diameter Signaling Router"				< 8.3 Search vendor "Oracle" for product "Communications Diameter Signaling Router" and version " < 8.3"		-		Affected
Oracle Search vendor "Oracle"		Communications Network Integrity Search vendor "Oracle" for product "Communications Network Integrity"				>= 7.3.2 <= 7.3.6 Search vendor "Oracle" for product "Communications Network Integrity" and version " >= 7.3.2 <= 7.3.6"		-		Affected
Oracle Search vendor "Oracle"		Communications Performance Intelligence Center Search vendor "Oracle" for product "Communications Performance Intelligence Center"				< 10.2.1 Search vendor "Oracle" for product "Communications Performance Intelligence Center" and version " < 10.2.1"		-		Affected
Oracle Search vendor "Oracle"		Communications Services Gatekeeper Search vendor "Oracle" for product "Communications Services Gatekeeper"				< 6.1.0.4.0 Search vendor "Oracle" for product "Communications Services Gatekeeper" and version " < 6.1.0.4.0"		-		Affected
Oracle Search vendor "Oracle"		Endeca Information Discovery Integrator Search vendor "Oracle" for product "Endeca Information Discovery Integrator"				3.1.0 Search vendor "Oracle" for product "Endeca Information Discovery Integrator" and version "3.1.0"		-		Affected
Oracle Search vendor "Oracle"		Endeca Information Discovery Integrator Search vendor "Oracle" for product "Endeca Information Discovery Integrator"				3.2.0 Search vendor "Oracle" for product "Endeca Information Discovery Integrator" and version "3.2.0"		-		Affected
Oracle Search vendor "Oracle"		Enterprise Manager For Mysql Database Search vendor "Oracle" for product "Enterprise Manager For Mysql Database"				13.2 Search vendor "Oracle" for product "Enterprise Manager For Mysql Database" and version "13.2"		-		Affected
Oracle Search vendor "Oracle"		Enterprise Manager Ops Center Search vendor "Oracle" for product "Enterprise Manager Ops Center"				12.2.2 Search vendor "Oracle" for product "Enterprise Manager Ops Center" and version "12.2.2"		-		Affected
Oracle Search vendor "Oracle"		Enterprise Manager Ops Center Search vendor "Oracle" for product "Enterprise Manager Ops Center"				12.3.3 Search vendor "Oracle" for product "Enterprise Manager Ops Center" and version "12.3.3"		-		Affected
Oracle Search vendor "Oracle"		Enterprise Repository Search vendor "Oracle" for product "Enterprise Repository"				11.1.1.7.0 Search vendor "Oracle" for product "Enterprise Repository" and version "11.1.1.7.0"		-		Affected
Oracle Search vendor "Oracle"		Enterprise Repository Search vendor "Oracle" for product "Enterprise Repository"				12.1.3.0.0 Search vendor "Oracle" for product "Enterprise Repository" and version "12.1.3.0.0"		-		Affected
Oracle Search vendor "Oracle"		Goldengate For Big Data Search vendor "Oracle" for product "Goldengate For Big Data"				12.2.0.1 Search vendor "Oracle" for product "Goldengate For Big Data" and version "12.2.0.1"		-		Affected
Oracle Search vendor "Oracle"		Goldengate For Big Data Search vendor "Oracle" for product "Goldengate For Big Data"				12.3.1.1 Search vendor "Oracle" for product "Goldengate For Big Data" and version "12.3.1.1"		-		Affected
Oracle Search vendor "Oracle"		Goldengate For Big Data Search vendor "Oracle" for product "Goldengate For Big Data"				12.3.2.1 Search vendor "Oracle" for product "Goldengate For Big Data" and version "12.3.2.1"		-		Affected
Oracle Search vendor "Oracle"		Health Sciences Information Manager Search vendor "Oracle" for product "Health Sciences Information Manager"				3.0 Search vendor "Oracle" for product "Health Sciences Information Manager" and version "3.0"		-		Affected
Oracle Search vendor "Oracle"		Healthcare Master Person Index Search vendor "Oracle" for product "Healthcare Master Person Index"				3.0 Search vendor "Oracle" for product "Healthcare Master Person Index" and version "3.0"		-		Affected
Oracle Search vendor "Oracle"		Healthcare Master Person Index Search vendor "Oracle" for product "Healthcare Master Person Index"				4.0 Search vendor "Oracle" for product "Healthcare Master Person Index" and version "4.0"		-		Affected
Oracle Search vendor "Oracle"		Hospitality Guest Access Search vendor "Oracle" for product "Hospitality Guest Access"				4.2.0 Search vendor "Oracle" for product "Hospitality Guest Access" and version "4.2.0"		-		Affected
Oracle Search vendor "Oracle"		Hospitality Guest Access Search vendor "Oracle" for product "Hospitality Guest Access"				4.2.1 Search vendor "Oracle" for product "Hospitality Guest Access" and version "4.2.1"		-		Affected
Oracle Search vendor "Oracle"		Insurance Calculation Engine Search vendor "Oracle" for product "Insurance Calculation Engine"				10.1.1 Search vendor "Oracle" for product "Insurance Calculation Engine" and version "10.1.1"		-		Affected
Oracle Search vendor "Oracle"		Insurance Calculation Engine Search vendor "Oracle" for product "Insurance Calculation Engine"				10.2 Search vendor "Oracle" for product "Insurance Calculation Engine" and version "10.2"		-		Affected
Oracle Search vendor "Oracle"		Insurance Calculation Engine Search vendor "Oracle" for product "Insurance Calculation Engine"				10.2.1 Search vendor "Oracle" for product "Insurance Calculation Engine" and version "10.2.1"		-		Affected
Oracle Search vendor "Oracle"		Insurance Policy Administration Search vendor "Oracle" for product "Insurance Policy Administration"				10.0 Search vendor "Oracle" for product "Insurance Policy Administration" and version "10.0"		-		Affected
Oracle Search vendor "Oracle"		Insurance Policy Administration Search vendor "Oracle" for product "Insurance Policy Administration"				10.1 Search vendor "Oracle" for product "Insurance Policy Administration" and version "10.1"		-		Affected
Oracle Search vendor "Oracle"		Insurance Policy Administration Search vendor "Oracle" for product "Insurance Policy Administration"				10.2 Search vendor "Oracle" for product "Insurance Policy Administration" and version "10.2"		-		Affected
Oracle Search vendor "Oracle"		Insurance Policy Administration Search vendor "Oracle" for product "Insurance Policy Administration"				11.0 Search vendor "Oracle" for product "Insurance Policy Administration" and version "11.0"		-		Affected
Oracle Search vendor "Oracle"		Insurance Rules Palette Search vendor "Oracle" for product "Insurance Rules Palette"				10.0 Search vendor "Oracle" for product "Insurance Rules Palette" and version "10.0"		-		Affected
Oracle Search vendor "Oracle"		Insurance Rules Palette Search vendor "Oracle" for product "Insurance Rules Palette"				10.1 Search vendor "Oracle" for product "Insurance Rules Palette" and version "10.1"		-		Affected
Oracle Search vendor "Oracle"		Insurance Rules Palette Search vendor "Oracle" for product "Insurance Rules Palette"				10.2 Search vendor "Oracle" for product "Insurance Rules Palette" and version "10.2"		-		Affected
Oracle Search vendor "Oracle"		Insurance Rules Palette Search vendor "Oracle" for product "Insurance Rules Palette"				11.0 Search vendor "Oracle" for product "Insurance Rules Palette" and version "11.0"		-		Affected
Oracle Search vendor "Oracle"		Insurance Rules Palette Search vendor "Oracle" for product "Insurance Rules Palette"				11.1 Search vendor "Oracle" for product "Insurance Rules Palette" and version "11.1"		-		Affected
Oracle Search vendor "Oracle"		Micros Lucas Search vendor "Oracle" for product "Micros Lucas"				2.9.5 Search vendor "Oracle" for product "Micros Lucas" and version "2.9.5"		-		Affected
Oracle Search vendor "Oracle"		Mysql Enterprise Monitor Search vendor "Oracle" for product "Mysql Enterprise Monitor"				<= 8.0.2.8191 Search vendor "Oracle" for product "Mysql Enterprise Monitor" and version " <= 8.0.2.8191"		-		Affected
Oracle Search vendor "Oracle"		Peoplesoft Enterprise Fin Install Search vendor "Oracle" for product "Peoplesoft Enterprise Fin Install"				9.2 Search vendor "Oracle" for product "Peoplesoft Enterprise Fin Install" and version "9.2"		-		Affected
Oracle Search vendor "Oracle"		Retail Assortment Planning Search vendor "Oracle" for product "Retail Assortment Planning"				14.1 Search vendor "Oracle" for product "Retail Assortment Planning" and version "14.1"		-		Affected
Oracle Search vendor "Oracle"		Retail Assortment Planning Search vendor "Oracle" for product "Retail Assortment Planning"				15.0 Search vendor "Oracle" for product "Retail Assortment Planning" and version "15.0"		-		Affected
Oracle Search vendor "Oracle"		Retail Assortment Planning Search vendor "Oracle" for product "Retail Assortment Planning"				16.0 Search vendor "Oracle" for product "Retail Assortment Planning" and version "16.0"		-		Affected
Oracle Search vendor "Oracle"		Retail Back Office Search vendor "Oracle" for product "Retail Back Office"				14.0 Search vendor "Oracle" for product "Retail Back Office" and version "14.0"		-		Affected
Oracle Search vendor "Oracle"		Retail Back Office Search vendor "Oracle" for product "Retail Back Office"				14.1 Search vendor "Oracle" for product "Retail Back Office" and version "14.1"		-		Affected
Oracle Search vendor "Oracle"		Retail Central Office Search vendor "Oracle" for product "Retail Central Office"				14.0 Search vendor "Oracle" for product "Retail Central Office" and version "14.0"		-		Affected
Oracle Search vendor "Oracle"		Retail Central Office Search vendor "Oracle" for product "Retail Central Office"				14.1 Search vendor "Oracle" for product "Retail Central Office" and version "14.1"		-		Affected
Oracle Search vendor "Oracle"		Retail Customer Insights Search vendor "Oracle" for product "Retail Customer Insights"				15.0 Search vendor "Oracle" for product "Retail Customer Insights" and version "15.0"		-		Affected
Oracle Search vendor "Oracle"		Retail Customer Insights Search vendor "Oracle" for product "Retail Customer Insights"				16.0 Search vendor "Oracle" for product "Retail Customer Insights" and version "16.0"		-		Affected
Oracle Search vendor "Oracle"		Retail Financial Integration Search vendor "Oracle" for product "Retail Financial Integration"				13.2 Search vendor "Oracle" for product "Retail Financial Integration" and version "13.2"		-		Affected
Oracle Search vendor "Oracle"		Retail Financial Integration Search vendor "Oracle" for product "Retail Financial Integration"				14.0 Search vendor "Oracle" for product "Retail Financial Integration" and version "14.0"		-		Affected
Oracle Search vendor "Oracle"		Retail Financial Integration Search vendor "Oracle" for product "Retail Financial Integration"				14.1 Search vendor "Oracle" for product "Retail Financial Integration" and version "14.1"		-		Affected
Oracle Search vendor "Oracle"		Retail Financial Integration Search vendor "Oracle" for product "Retail Financial Integration"				15.0 Search vendor "Oracle" for product "Retail Financial Integration" and version "15.0"		-		Affected
Oracle Search vendor "Oracle"		Retail Financial Integration Search vendor "Oracle" for product "Retail Financial Integration"				16.0 Search vendor "Oracle" for product "Retail Financial Integration" and version "16.0"		-		Affected
Oracle Search vendor "Oracle"		Retail Integration Bus Search vendor "Oracle" for product "Retail Integration Bus"				14.1.2 Search vendor "Oracle" for product "Retail Integration Bus" and version "14.1.2"		-		Affected
Oracle Search vendor "Oracle"		Retail Point-of-service Search vendor "Oracle" for product "Retail Point-of-service"				14.0 Search vendor "Oracle" for product "Retail Point-of-service" and version "14.0"		-		Affected
Oracle Search vendor "Oracle"		Retail Point-of-service Search vendor "Oracle" for product "Retail Point-of-service"				14.1 Search vendor "Oracle" for product "Retail Point-of-service" and version "14.1"		-		Affected
Oracle Search vendor "Oracle"		Retail Returns Management Search vendor "Oracle" for product "Retail Returns Management"				14.0 Search vendor "Oracle" for product "Retail Returns Management" and version "14.0"		-		Affected
Oracle Search vendor "Oracle"		Retail Returns Management Search vendor "Oracle" for product "Retail Returns Management"				14.1 Search vendor "Oracle" for product "Retail Returns Management" and version "14.1"		-		Affected
Oracle Search vendor "Oracle"		Retail Xstore Point Of Service Search vendor "Oracle" for product "Retail Xstore Point Of Service"				17.0 Search vendor "Oracle" for product "Retail Xstore Point Of Service" and version "17.0"		-		Affected
Oracle Search vendor "Oracle"		Service Architecture Leveraging Tuxedo Search vendor "Oracle" for product "Service Architecture Leveraging Tuxedo"				12.1.3.0.0 Search vendor "Oracle" for product "Service Architecture Leveraging Tuxedo" and version "12.1.3.0.0"		-		Affected
Oracle Search vendor "Oracle"		Service Architecture Leveraging Tuxedo Search vendor "Oracle" for product "Service Architecture Leveraging Tuxedo"				12.2.2.0.0 Search vendor "Oracle" for product "Service Architecture Leveraging Tuxedo" and version "12.2.2.0.0"		-		Affected
Oracle Search vendor "Oracle"		Tape Library Acsls Search vendor "Oracle" for product "Tape Library Acsls"				8.4 Search vendor "Oracle" for product "Tape Library Acsls" and version "8.4"		-		Affected
Oracle Search vendor "Oracle"		Weblogic Server Search vendor "Oracle" for product "Weblogic Server"				10.3.6.0 Search vendor "Oracle" for product "Weblogic Server" and version "10.3.6.0"		-		Affected
Oracle Search vendor "Oracle"		Weblogic Server Search vendor "Oracle" for product "Weblogic Server"				12.1.3.0 Search vendor "Oracle" for product "Weblogic Server" and version "12.1.3.0"		-		Affected
Oracle Search vendor "Oracle"		Weblogic Server Search vendor "Oracle" for product "Weblogic Server"				12.2.1.2 Search vendor "Oracle" for product "Weblogic Server" and version "12.2.1.2"		-		Affected
Oracle Search vendor "Oracle"		Weblogic Server Search vendor "Oracle" for product "Weblogic Server"				12.2.1.3 Search vendor "Oracle" for product "Weblogic Server" and version "12.2.1.3"		-		Affected
Netapp Search vendor "Netapp"		Oncommand Insight Search vendor "Netapp" for product "Oncommand Insight"				-		-		Affected
Netapp Search vendor "Netapp"		Oncommand Unified Manager Search vendor "Netapp" for product "Oncommand Unified Manager"				>= 7.3 Search vendor "Netapp" for product "Oncommand Unified Manager" and version " >= 7.3"		windows		Affected
Netapp Search vendor "Netapp"		Oncommand Unified Manager Search vendor "Netapp" for product "Oncommand Unified Manager"				>= 9.4 Search vendor "Netapp" for product "Oncommand Unified Manager" and version " >= 9.4"		vsphere		Affected
Netapp Search vendor "Netapp"		Oncommand Workflow Automation Search vendor "Netapp" for product "Oncommand Workflow Automation"				-		-		Affected
Netapp Search vendor "Netapp"		Snapcenter Search vendor "Netapp" for product "Snapcenter"				-		-		Affected
Netapp Search vendor "Netapp"		Storage Automation Store Search vendor "Netapp" for product "Storage Automation Store"				-		-		Affected
Redhat Search vendor "Redhat"		Fuse Search vendor "Redhat" for product "Fuse"				7.3.0 Search vendor "Redhat" for product "Fuse" and version "7.3.0"		-		Affected