CVE-2018-1258

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.
References
Link Resource
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html Patch Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html Patch Third Party Advisory
http://www.securityfocus.com/bid/104222 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1041888 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1041896 Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2019:2413 Patch Third Party Advisory
https://pivotal.io/security/cve-2018-1258 Vendor Advisory
https://security.netapp.com/advisory/ntap-20181018-0002/ Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.html Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2020.html Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html Patch Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html Patch Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html Patch Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html Patch Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html Patch Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html Patch Third Party Advisory
http://www.securityfocus.com/bid/104222 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1041888 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1041896 Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2019:2413 Patch Third Party Advisory
https://pivotal.io/security/cve-2018-1258 Vendor Advisory
https://security.netapp.com/advisory/ntap-20181018-0002/ Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.html Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2020.html Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html Patch Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html Patch Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html Patch Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html Patch Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:pivotal_software:spring_security:*:*:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_framework:5.0.5:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:oracle:agile_plm:9.3.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:agile_plm:9.3.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:agile_plm:9.3.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*
cpe:2.3:a:oracle:application_testing_suite:10.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:application_testing_suite:13.1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:application_testing_suite:13.2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:big_data_discovery:1.6.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_converged_application_server:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_network_integrity:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_performance_intelligence_center:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_services_gatekeeper:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:endeca_information_discovery_integrator:3.1.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:endeca_information_discovery_integrator:3.2.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_manager_for_mysql_database:13.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_repository:11.1.1.7.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_repository:12.1.3.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:goldengate_for_big_data:12.2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:goldengate_for_big_data:12.3.1.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:goldengate_for_big_data:12.3.2.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:health_sciences_information_manager:3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:healthcare_master_person_index:3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:healthcare_master_person_index:4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:insurance_calculation_engine:10.1.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:insurance_calculation_engine:10.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:insurance_calculation_engine:10.2.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:insurance_policy_administration:10.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:insurance_policy_administration:10.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:insurance_policy_administration:10.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:insurance_policy_administration:11.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:insurance_rules_palette:10.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:insurance_rules_palette:10.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:insurance_rules_palette:10.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:insurance_rules_palette:11.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:insurance_rules_palette:11.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:micros_lucas:2.9.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:peoplesoft_enterprise_fin_install:9.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_assortment_planning:14.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_assortment_planning:15.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_assortment_planning:16.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_central_office:14.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_central_office:14.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_customer_insights:15.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_customer_insights:16.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_financial_integration:13.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_financial_integration:14.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_financial_integration:14.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_financial_integration:15.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_financial_integration:16.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_integration_bus:14.1.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_point-of-service:14.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_point-of-service:14.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_returns_management:14.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:service_architecture_leveraging_tuxedo:12.1.3.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:service_architecture_leveraging_tuxedo:12.2.2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:tape_library_acsls:8.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:weblogic_server:10.3.6.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:weblogic_server:12.1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:weblogic_server:12.2.1.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:weblogic_server:12.2.1.3:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:windows:*:*
cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:vsphere:*:*
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:storage_automation_store:-:*:*:*:*:*:*:*

Configuration 4 (hide)

cpe:2.3:a:redhat:fuse:7.3.0:*:*:*:*:*:*:*

History

21 Nov 2024, 03:59

Type Values Removed Values Added
References () http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - Patch, Third Party Advisory () http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - Patch, Third Party Advisory
References () http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - Patch, Third Party Advisory () http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - Patch, Third Party Advisory
References () http://www.securityfocus.com/bid/104222 - Third Party Advisory, VDB Entry () http://www.securityfocus.com/bid/104222 - Third Party Advisory, VDB Entry
References () http://www.securitytracker.com/id/1041888 - Third Party Advisory, VDB Entry () http://www.securitytracker.com/id/1041888 - Third Party Advisory, VDB Entry
References () http://www.securitytracker.com/id/1041896 - Third Party Advisory, VDB Entry () http://www.securitytracker.com/id/1041896 - Third Party Advisory, VDB Entry
References () https://access.redhat.com/errata/RHSA-2019:2413 - Patch, Third Party Advisory () https://access.redhat.com/errata/RHSA-2019:2413 - Patch, Third Party Advisory
References () https://pivotal.io/security/cve-2018-1258 - Vendor Advisory () https://pivotal.io/security/cve-2018-1258 - Vendor Advisory
References () https://security.netapp.com/advisory/ntap-20181018-0002/ - Third Party Advisory () https://security.netapp.com/advisory/ntap-20181018-0002/ - Third Party Advisory
References () https://www.oracle.com/security-alerts/cpuapr2020.html - Patch, Third Party Advisory () https://www.oracle.com/security-alerts/cpuapr2020.html - Patch, Third Party Advisory
References () https://www.oracle.com/security-alerts/cpujan2020.html - Patch, Third Party Advisory () https://www.oracle.com/security-alerts/cpujan2020.html - Patch, Third Party Advisory
References () https://www.oracle.com/security-alerts/cpujan2021.html - Patch, Third Party Advisory () https://www.oracle.com/security-alerts/cpujan2021.html - Patch, Third Party Advisory
References () https://www.oracle.com/security-alerts/cpujul2020.html - Patch, Third Party Advisory () https://www.oracle.com/security-alerts/cpujul2020.html - Patch, Third Party Advisory
References () https://www.oracle.com/security-alerts/cpuoct2021.html - Patch, Third Party Advisory () https://www.oracle.com/security-alerts/cpuoct2021.html - Patch, Third Party Advisory
References () https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - Patch, Third Party Advisory () https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - Patch, Third Party Advisory
References () https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - Patch, Third Party Advisory () https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - Patch, Third Party Advisory
References () https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - Patch, Third Party Advisory () https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - Patch, Third Party Advisory

Information

Published : 2018-05-11 20:29

Updated : 2024-11-21 03:59


NVD link : CVE-2018-1258

Mitre link : CVE-2018-1258

CVE.ORG link : CVE-2018-1258


JSON object : View

Products Affected

oracle

  • communications_services_gatekeeper
  • enterprise_repository
  • endeca_information_discovery_integrator
  • insurance_policy_administration
  • peoplesoft_enterprise_fin_install
  • communications_converged_application_server
  • retail_financial_integration
  • healthcare_master_person_index
  • application_testing_suite
  • retail_point-of-service
  • agile_plm
  • communications_network_integrity
  • weblogic_server
  • retail_back_office
  • communications_performance_intelligence_center
  • service_architecture_leveraging_tuxedo
  • retail_central_office
  • enterprise_manager_for_mysql_database
  • insurance_rules_palette
  • big_data_discovery
  • enterprise_manager_ops_center
  • retail_assortment_planning
  • goldengate_for_big_data
  • micros_lucas
  • health_sciences_information_manager
  • insurance_calculation_engine
  • communications_diameter_signaling_router
  • mysql_enterprise_monitor
  • retail_integration_bus
  • tape_library_acsls
  • retail_customer_insights
  • hospitality_guest_access
  • retail_xstore_point_of_service
  • retail_returns_management

netapp

  • oncommand_unified_manager
  • storage_automation_store
  • oncommand_insight
  • snapcenter
  • oncommand_workflow_automation

redhat

  • fuse

pivotal_software

  • spring_security

vmware

  • spring_framework
CWE
CWE-863

Incorrect Authorization