CVE-2018-1270: spring framework before 4.3.16 (exclusive), from 5.0.0 (inclusive), before 5.0.5 (exclusive); +28 more affected products

Affected technology

spring framework · before 4.3.16 (exclusive)
vmware

spring framework · from 5.0.0 (inclusive), before 5.0.5 (exclusive)
vmware

application testing suite · 12.5.0.3
oracle

application testing suite · 13.1.0.1
oracle

application testing suite · 13.2.0.1
oracle

application testing suite · 13.3.0.1
oracle

big data discovery · 1.6.0
oracle

communications converged application server · before 7.0.0.1 (exclusive)
oracle

communications diameter signaling router · before 8.3 (exclusive)
oracle

communications performance intelligence center · before 10.2.1 (exclusive)
oracle

communications services gatekeeper · before 6.1.0.4.0 (exclusive)
oracle

enterprise manager ops center · 12.2.2
oracle

enterprise manager ops center · 12.3.3
oracle

goldengate for big data · 12.2.0.1
oracle

goldengate for big data · 12.3.1.1
oracle

goldengate for big data · 12.3.2.1
oracle

health sciences information manager · 3.0
oracle

healthcare master person index · 3.0
oracle

healthcare master person index · 4.0
oracle

insurance calculation engine · 10.1.1
oracle

insurance calculation engine · 10.2
oracle

insurance calculation engine · 10.2.1
oracle

insurance rules palette · 10.0
oracle

insurance rules palette · 10.1
oracle

insurance rules palette · 10.2
oracle

insurance rules palette · 11.0
oracle

insurance rules palette · 11.1
oracle

primavera gateway · 15.2
oracle

primavera gateway · 16.2
oracle

primavera gateway · 17.12
oracle

retail back office · 14.0
oracle

retail back office · 14.1
oracle

retail central office · 14.0
oracle

retail central office · 14.1
oracle

retail customer insights · 15.0
oracle

retail customer insights · 16.0
oracle

retail integration bus · 14.0.1
oracle

retail integration bus · 14.0.2
oracle

retail integration bus · 14.0.3
oracle

retail integration bus · 14.0.4
oracle

retail integration bus · 14.1.1
oracle

retail integration bus · 14.1.2
oracle

retail integration bus · 14.1.3
oracle

retail integration bus · 15.0.0.1
oracle

retail integration bus · 15.0.1
oracle

retail integration bus · 15.0.2
oracle

retail integration bus · 16.0
oracle

retail integration bus · 16.0.1
oracle

retail integration bus · 16.0.2
oracle

retail open commerce platform · 5.3.0
oracle

retail open commerce platform · 6.0.0
oracle

retail open commerce platform · 6.0.1
oracle

retail order broker · 5.1
oracle

retail order broker · 5.2
oracle

retail order broker · 15.0
oracle

retail order broker · 16.0
oracle

retail point-of-sale · 14.0
oracle

retail point-of-sale · 14.1
oracle

retail predictive application server · 14.0
oracle

retail predictive application server · 14.1
oracle

retail predictive application server · 15.0
oracle

retail predictive application server · 16.0
oracle

retail returns management · 14.0
oracle

retail returns management · 14.1
oracle

retail xstore point of service · 7.1
oracle

service architecture leveraging tuxedo · 12.1.3.0.0
oracle

service architecture leveraging tuxedo · 12.2.2.0.0
oracle

tape library acsls · 8.4
oracle

fuse · 1.0.0
redhat

debian linux · 9.0
debian

Spring Framework · Versions prior to 5.0.5 and 4.3.15
Spring by Pivotal

Description’s affected range: versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions,

Component: Not specified by the source

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source reports that an attacker could run code remotely. NVD’s CVSS 3.1 assessment (base score 9.8/10) rates confidentiality, integrity and availability impact as high.