CVE-2018-1257: spring framework before 4.3.17 (exclusive), from 5.0.0 (inclusive), before 5.0.6 (exclusive); +30 more affected products

Affected technology

spring framework · before 4.3.17 (exclusive)
vmware

spring framework · from 5.0.0 (inclusive), before 5.0.6 (exclusive)
vmware

openshift · Version not applicable in the source CPE
redhat

agile product lifecycle management · 9.3.3
oracle

agile product lifecycle management · 9.3.4
oracle

agile product lifecycle management · 9.3.5
oracle

agile product lifecycle management · 9.3.6
oracle

application testing suite · 12.5.0.3
oracle

application testing suite · 13.1.0.1
oracle

application testing suite · 13.2.0.1
oracle

application testing suite · 13.3.0.1
oracle

big data discovery · 1.6.0
oracle

communications converged application server · before 7.0.0.1 (exclusive)
oracle

communications diameter signaling router · before 8.3 (exclusive)
oracle

communications performance intelligence center · before 10.2.1 (exclusive)
oracle

communications services gatekeeper · before 6.1.0.4.0 (exclusive)
oracle

communications unified inventory management · 7.3.2
oracle

communications unified inventory management · 7.3.4
oracle

communications unified inventory management · 7.3.5
oracle

communications unified inventory management · 7.4.0
oracle

endeca information discovery integrator · 3.1.0
oracle

endeca information discovery integrator · 3.2.0
oracle

enterprise manager base platform · 12.1.0.5.0
oracle

enterprise manager base platform · 13.2.0.0.0
oracle

enterprise manager base platform · 13.3.0.0.0
oracle

enterprise manager for mysql database · 13.2
oracle

enterprise manager ops center · 12.3.3
oracle

flexcube private banking · 2.0.0.0
oracle

flexcube private banking · 2.2.0.1
oracle

flexcube private banking · 12.0.1.0
oracle

flexcube private banking · 12.0.3.0
oracle

flexcube private banking · 12.1.0.0
oracle

goldengate for big data · 12.2.0.1
oracle

goldengate for big data · 12.3.1.1
oracle

goldengate for big data · 12.3.2.1
oracle

health sciences information manager · 3.0
oracle

healthcare master person index · 3.0
oracle

healthcare master person index · 4.0
oracle

hospitality guest access · 4.2.0
oracle

hospitality guest access · 4.2.1
oracle

insurance calculation engine · 10.1.1
oracle

insurance calculation engine · 10.2
oracle

insurance calculation engine · 10.2.1
oracle

insurance rules palette · 10.0
oracle

insurance rules palette · 10.1
oracle

insurance rules palette · 10.2
oracle

insurance rules palette · 11.0
oracle

insurance rules palette · 11.1
oracle

primavera gateway · 15.2
oracle

primavera gateway · 16.2
oracle

primavera gateway · 17.12
oracle

retail customer insights · 15.0
oracle

retail customer insights · 16.0
oracle

retail open commerce platform · 5.3.0
oracle

retail open commerce platform · 6.0.0
oracle

retail open commerce platform · 6.0.1
oracle

retail order broker · 5.1
oracle

retail order broker · 5.2
oracle

retail order broker · 15.0
oracle

retail order broker · 16.0
oracle

retail predictive application server · 14.0
oracle

retail predictive application server · 14.1
oracle

retail predictive application server · 15.0
oracle

retail predictive application server · 16.0
oracle

service architecture leveraging tuxedo · 12.1.3.0.0
oracle

service architecture leveraging tuxedo · 12.2.2.0.0
oracle

tape library acsls · 8.4
oracle

utilities network management system · 1.12.0.3
oracle

weblogic server · 10.3.6.0.0
oracle

weblogic server · 12.1.3.0.0
oracle

weblogic server · 12.2.1.3.0
oracle

Spring Framework · 5.0.x prior to 5.0.6; 4.3.x prior to 4.3.17
Pivotal

Description’s affected range: versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions

Component: Not specified by the source

Attack conditions (NVD, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

The source reports that an attacker could disrupt service. NVD’s CVSS 3.1 assessment (base score 6.5/10) rates confidentiality and integrity impact as none; availability impact as high.