CVE-2018-1258

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:pivotal_software:spring_security:*:*:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_framework:5.0.5:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:oracle:agile_plm:9.3.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:agile_plm:9.3.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:agile_plm:9.3.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*
cpe:2.3:a:oracle:application_testing_suite:10.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:application_testing_suite:13.1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:application_testing_suite:13.2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:big_data_discovery:1.6.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_converged_application_server:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_network_integrity:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_performance_intelligence_center:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_services_gatekeeper:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:endeca_information_discovery_integrator:3.1.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:endeca_information_discovery_integrator:3.2.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_manager_for_mysql_database:13.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_repository:11.1.1.7.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_repository:12.1.3.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:goldengate_for_big_data:12.2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:goldengate_for_big_data:12.3.1.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:goldengate_for_big_data:12.3.2.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:health_sciences_information_manager:3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:healthcare_master_person_index:3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:healthcare_master_person_index:4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:insurance_calculation_engine:10.1.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:insurance_calculation_engine:10.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:insurance_calculation_engine:10.2.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:insurance_policy_administration:10.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:insurance_policy_administration:10.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:insurance_policy_administration:10.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:insurance_policy_administration:11.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:insurance_rules_palette:10.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:insurance_rules_palette:10.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:insurance_rules_palette:10.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:insurance_rules_palette:11.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:insurance_rules_palette:11.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:micros_lucas:2.9.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:peoplesoft_enterprise_fin_install:9.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_assortment_planning:14.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_assortment_planning:15.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_assortment_planning:16.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_central_office:14.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_central_office:14.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_customer_insights:15.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_customer_insights:16.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_financial_integration:13.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_financial_integration:14.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_financial_integration:14.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_financial_integration:15.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_financial_integration:16.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_integration_bus:14.1.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_point-of-service:14.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_point-of-service:14.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_returns_management:14.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:service_architecture_leveraging_tuxedo:12.1.3.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:service_architecture_leveraging_tuxedo:12.2.2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:tape_library_acsls:8.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:weblogic_server:10.3.6.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:weblogic_server:12.1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:weblogic_server:12.2.1.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:weblogic_server:12.2.1.3:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:windows:*:*
cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:vsphere:*:*
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:storage_automation_store:-:*:*:*:*:*:*:*

Configuration 4 (hide)

cpe:2.3:a:redhat:fuse:7.3.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-05-11 20:29

Updated : 2024-02-28 16:25


NVD link : CVE-2018-1258

Mitre link : CVE-2018-1258

CVE.ORG link : CVE-2018-1258


JSON object : View

Products Affected

oracle

  • communications_diameter_signaling_router
  • retail_central_office
  • application_testing_suite
  • retail_integration_bus
  • retail_customer_insights
  • enterprise_manager_ops_center
  • service_architecture_leveraging_tuxedo
  • communications_network_integrity
  • communications_performance_intelligence_center
  • retail_xstore_point_of_service
  • retail_point-of-service
  • peoplesoft_enterprise_fin_install
  • health_sciences_information_manager
  • communications_converged_application_server
  • big_data_discovery
  • enterprise_repository
  • retail_returns_management
  • goldengate_for_big_data
  • retail_back_office
  • insurance_calculation_engine
  • hospitality_guest_access
  • insurance_rules_palette
  • retail_financial_integration
  • endeca_information_discovery_integrator
  • tape_library_acsls
  • insurance_policy_administration
  • mysql_enterprise_monitor
  • retail_assortment_planning
  • healthcare_master_person_index
  • agile_plm
  • enterprise_manager_for_mysql_database
  • weblogic_server
  • communications_services_gatekeeper
  • micros_lucas

pivotal_software

  • spring_security

netapp

  • storage_automation_store
  • oncommand_insight
  • oncommand_unified_manager
  • snapcenter
  • oncommand_workflow_automation

redhat

  • fuse

vmware

  • spring_framework
CWE
CWE-863

Incorrect Authorization