CVE-2018-1258GHSA-CXRJ-66C5-9FMH
Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using met
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 5.0.6.RELEASE
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.
Timeline
- CVE published
- Record last updated
Affected versions
- Pivotal Spring Framework
5.0.5
- org.springframework:spring-coreMaven
From 5.0.5.RELEASE · fixed in 5.0.6.RELEASE
References 16
securityfocus.com
securitytracker.com
access.redhat.com
oracle.com
- security-alerts/cpuapr2020.html
- technetwork/security-advisory/cpujul2018-4258247.html
- technetwork/security-advisory/cpuoct2018-4428296.html
- security-alerts/cpujul2020.html
- technetwork/security-advisory/cpujan2019-5072801.html
- technetwork/security-advisory/cpuapr2019-5072813.html
- technetwork/security-advisory/cpujul2019-5072835.html
- security-alerts/cpujan2020.html
- security-alerts/cpujan2021.html
- security-alerts/cpuoct2021.html