CVE-2018-1270 (CNNVD-201804-245)
CRITICAL
中文标题:
Pivotal Software Spring Framework 代码注入漏洞
英文标题:
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported...
CVSS分数:
9.8
发布时间:
2018-04-06 13:00:00
漏洞类型:
代码注入
状态:
PUBLISHED
数据质量分数:
0.30
数据版本:
v3
漏洞描述
中文描述:
Vmware Spring Framework是美国威睿（Vmware）公司的一套开源的Java、JavaEE应用程序框架。该框架可帮助开发人员构建高质量的应用。 Spring Framework 5.0.5之前的5.0版本、4.3.15之前的4.3版本和不再支持的老版本中存在代码注入漏洞。该漏洞是源于网络系统或产品中缺少身份验证、访问控制、权限管理等安全措施。
英文描述:
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.
CWE类型:
CWE-358
CWE-94
标签:
（暂无数据）
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Spring by Pivotal | Spring Framework | Versions prior to 5.0.5 and 4.3.15 | - | - |
cpe:2.3:a:spring_by_pivotal:spring_framework:versions_prior_to_5.0.5_and_4.3.15:*:*:*:*:*:*:*
|
| vmware | spring_framework | * | - | - |
cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*
|
| oracle | application_testing_suite | 12.5.0.3 | - | - |
cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:*:*:*:*:*:*:*
|
| oracle | application_testing_suite | 13.1.0.1 | - | - |
cpe:2.3:a:oracle:application_testing_suite:13.1.0.1:*:*:*:*:*:*:*
|
| oracle | application_testing_suite | 13.2.0.1 | - | - |
cpe:2.3:a:oracle:application_testing_suite:13.2.0.1:*:*:*:*:*:*:*
|
| oracle | application_testing_suite | 13.3.0.1 | - | - |
cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*
|
| oracle | big_data_discovery | 1.6.0 | - | - |
cpe:2.3:a:oracle:big_data_discovery:1.6.0:*:*:*:*:*:*:*
|
| oracle | communications_converged_application_server | * | - | - |
cpe:2.3:a:oracle:communications_converged_application_server:*:*:*:*:*:*:*:*
|
| oracle | communications_diameter_signaling_router | * | - | - |
cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*
|
| oracle | communications_performance_intelligence_center | * | - | - |
cpe:2.3:a:oracle:communications_performance_intelligence_center:*:*:*:*:*:*:*:*
|
| oracle | communications_services_gatekeeper | * | - | - |
cpe:2.3:a:oracle:communications_services_gatekeeper:*:*:*:*:*:*:*:*
|
| oracle | enterprise_manager_ops_center | 12.2.2 | - | - |
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.2:*:*:*:*:*:*:*
|
| oracle | enterprise_manager_ops_center | 12.3.3 | - | - |
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:*
|
| oracle | goldengate_for_big_data | 12.2.0.1 | - | - |
cpe:2.3:a:oracle:goldengate_for_big_data:12.2.0.1:*:*:*:*:*:*:*
|
| oracle | goldengate_for_big_data | 12.3.1.1 | - | - |
cpe:2.3:a:oracle:goldengate_for_big_data:12.3.1.1:*:*:*:*:*:*:*
|
| oracle | goldengate_for_big_data | 12.3.2.1 | - | - |
cpe:2.3:a:oracle:goldengate_for_big_data:12.3.2.1:*:*:*:*:*:*:*
|
| oracle | health_sciences_information_manager | 3.0 | - | - |
cpe:2.3:a:oracle:health_sciences_information_manager:3.0:*:*:*:*:*:*:*
|
| oracle | healthcare_master_person_index | 3.0 | - | - |
cpe:2.3:a:oracle:healthcare_master_person_index:3.0:*:*:*:*:*:*:*
|
| oracle | healthcare_master_person_index | 4.0 | - | - |
cpe:2.3:a:oracle:healthcare_master_person_index:4.0:*:*:*:*:*:*:*
|
| oracle | insurance_calculation_engine | 10.1.1 | - | - |
cpe:2.3:a:oracle:insurance_calculation_engine:10.1.1:*:*:*:*:*:*:*
|
| oracle | insurance_calculation_engine | 10.2 | - | - |
cpe:2.3:a:oracle:insurance_calculation_engine:10.2:*:*:*:*:*:*:*
|
| oracle | insurance_calculation_engine | 10.2.1 | - | - |
cpe:2.3:a:oracle:insurance_calculation_engine:10.2.1:*:*:*:*:*:*:*
|
| oracle | insurance_rules_palette | 10.0 | - | - |
cpe:2.3:a:oracle:insurance_rules_palette:10.0:*:*:*:*:*:*:*
|
| oracle | insurance_rules_palette | 10.1 | - | - |
cpe:2.3:a:oracle:insurance_rules_palette:10.1:*:*:*:*:*:*:*
|
| oracle | insurance_rules_palette | 10.2 | - | - |
cpe:2.3:a:oracle:insurance_rules_palette:10.2:*:*:*:*:*:*:*
|
| oracle | insurance_rules_palette | 11.0 | - | - |
cpe:2.3:a:oracle:insurance_rules_palette:11.0:*:*:*:*:*:*:*
|
| oracle | insurance_rules_palette | 11.1 | - | - |
cpe:2.3:a:oracle:insurance_rules_palette:11.1:*:*:*:*:*:*:*
|
| oracle | primavera_gateway | 15.2 | - | - |
cpe:2.3:a:oracle:primavera_gateway:15.2:*:*:*:*:*:*:*
|
| oracle | primavera_gateway | 16.2 | - | - |
cpe:2.3:a:oracle:primavera_gateway:16.2:*:*:*:*:*:*:*
|
| oracle | primavera_gateway | 17.12 | - | - |
cpe:2.3:a:oracle:primavera_gateway:17.12:*:*:*:*:*:*:*
|
| oracle | retail_back_office | 14.0 | - | - |
cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:*
|
| oracle | retail_back_office | 14.1 | - | - |
cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:*
|
| oracle | retail_central_office | 14.0 | - | - |
cpe:2.3:a:oracle:retail_central_office:14.0:*:*:*:*:*:*:*
|
| oracle | retail_central_office | 14.1 | - | - |
cpe:2.3:a:oracle:retail_central_office:14.1:*:*:*:*:*:*:*
|
| oracle | retail_customer_insights | 15.0 | - | - |
cpe:2.3:a:oracle:retail_customer_insights:15.0:*:*:*:*:*:*:*
|
| oracle | retail_customer_insights | 16.0 | - | - |
cpe:2.3:a:oracle:retail_customer_insights:16.0:*:*:*:*:*:*:*
|
| oracle | retail_integration_bus | 14.0.1 | - | - |
cpe:2.3:a:oracle:retail_integration_bus:14.0.1:*:*:*:*:*:*:*
|
| oracle | retail_integration_bus | 14.0.2 | - | - |
cpe:2.3:a:oracle:retail_integration_bus:14.0.2:*:*:*:*:*:*:*
|
| oracle | retail_integration_bus | 14.0.3 | - | - |
cpe:2.3:a:oracle:retail_integration_bus:14.0.3:*:*:*:*:*:*:*
|
| oracle | retail_integration_bus | 14.0.4 | - | - |
cpe:2.3:a:oracle:retail_integration_bus:14.0.4:*:*:*:*:*:*:*
|
| oracle | retail_integration_bus | 14.1.1 | - | - |
cpe:2.3:a:oracle:retail_integration_bus:14.1.1:*:*:*:*:*:*:*
|
| oracle | retail_integration_bus | 14.1.2 | - | - |
cpe:2.3:a:oracle:retail_integration_bus:14.1.2:*:*:*:*:*:*:*
|
| oracle | retail_integration_bus | 14.1.3 | - | - |
cpe:2.3:a:oracle:retail_integration_bus:14.1.3:*:*:*:*:*:*:*
|
| oracle | retail_integration_bus | 15.0.0.1 | - | - |
cpe:2.3:a:oracle:retail_integration_bus:15.0.0.1:*:*:*:*:*:*:*
|
| oracle | retail_integration_bus | 15.0.1 | - | - |
cpe:2.3:a:oracle:retail_integration_bus:15.0.1:*:*:*:*:*:*:*
|
| oracle | retail_integration_bus | 15.0.2 | - | - |
cpe:2.3:a:oracle:retail_integration_bus:15.0.2:*:*:*:*:*:*:*
|
| oracle | retail_integration_bus | 16.0 | - | - |
cpe:2.3:a:oracle:retail_integration_bus:16.0:*:*:*:*:*:*:*
|
| oracle | retail_integration_bus | 16.0.1 | - | - |
cpe:2.3:a:oracle:retail_integration_bus:16.0.1:*:*:*:*:*:*:*
|
| oracle | retail_integration_bus | 16.0.2 | - | - |
cpe:2.3:a:oracle:retail_integration_bus:16.0.2:*:*:*:*:*:*:*
|
| oracle | retail_open_commerce_platform | 5.3.0 | - | - |
cpe:2.3:a:oracle:retail_open_commerce_platform:5.3.0:*:*:*:*:*:*:*
|
| oracle | retail_open_commerce_platform | 6.0.0 | - | - |
cpe:2.3:a:oracle:retail_open_commerce_platform:6.0.0:*:*:*:*:*:*:*
|
| oracle | retail_open_commerce_platform | 6.0.1 | - | - |
cpe:2.3:a:oracle:retail_open_commerce_platform:6.0.1:*:*:*:*:*:*:*
|
| oracle | retail_order_broker | 5.1 | - | - |
cpe:2.3:a:oracle:retail_order_broker:5.1:*:*:*:*:*:*:*
|
| oracle | retail_order_broker | 5.2 | - | - |
cpe:2.3:a:oracle:retail_order_broker:5.2:*:*:*:*:*:*:*
|
| oracle | retail_order_broker | 15.0 | - | - |
cpe:2.3:a:oracle:retail_order_broker:15.0:*:*:*:*:*:*:*
|
| oracle | retail_order_broker | 16.0 | - | - |
cpe:2.3:a:oracle:retail_order_broker:16.0:*:*:*:*:*:*:*
|
| oracle | retail_point-of-sale | 14.0 | - | - |
cpe:2.3:a:oracle:retail_point-of-sale:14.0:*:*:*:*:*:*:*
|
| oracle | retail_point-of-sale | 14.1 | - | - |
cpe:2.3:a:oracle:retail_point-of-sale:14.1:*:*:*:*:*:*:*
|
| oracle | retail_predictive_application_server | 14.0 | - | - |
cpe:2.3:a:oracle:retail_predictive_application_server:14.0:*:*:*:*:*:*:*
|
| oracle | retail_predictive_application_server | 14.1 | - | - |
cpe:2.3:a:oracle:retail_predictive_application_server:14.1:*:*:*:*:*:*:*
|
| oracle | retail_predictive_application_server | 15.0 | - | - |
cpe:2.3:a:oracle:retail_predictive_application_server:15.0:*:*:*:*:*:*:*
|
| oracle | retail_predictive_application_server | 16.0 | - | - |
cpe:2.3:a:oracle:retail_predictive_application_server:16.0:*:*:*:*:*:*:*
|
| oracle | retail_returns_management | 14.0 | - | - |
cpe:2.3:a:oracle:retail_returns_management:14.0:*:*:*:*:*:*:*
|
| oracle | retail_returns_management | 14.1 | - | - |
cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:*
|
| oracle | retail_xstore_point_of_service | 7.1 | - | - |
cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:*
|
| oracle | service_architecture_leveraging_tuxedo | 12.1.3.0.0 | - | - |
cpe:2.3:a:oracle:service_architecture_leveraging_tuxedo:12.1.3.0.0:*:*:*:*:*:*:*
|
| oracle | service_architecture_leveraging_tuxedo | 12.2.2.0.0 | - | - |
cpe:2.3:a:oracle:service_architecture_leveraging_tuxedo:12.2.2.0.0:*:*:*:*:*:*:*
|
| oracle | tape_library_acsls | 8.4 | - | - |
cpe:2.3:a:oracle:tape_library_acsls:8.4:*:*:*:*:*:*:*
|
| redhat | fuse | 1.0.0 | - | - |
cpe:2.3:a:redhat:fuse:1.0.0:*:*:*:*:*:*:*
|
| debian | debian_linux | 9.0 | - | - |
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
（暂无数据）
英文解决方案:
（暂无数据）
临时解决方案:
（暂无数据）
参考链接
RHSA-2018:2939
vendor-advisory
cve.org
访问
cve.org
44796
exploit
cve.org
访问
cve.org
103696
vdb-entry
cve.org
访问
cve.org
[activemq-issues] 20190703 [jira] [Created] (AMQ-7236) SEV-1 Security vulnerability in spring-expression-4.3.11.RELEASE.jar (spring framework)
mailing-list
cve.org
访问
cve.org
[activemq-issues] 20190703 [jira] [Updated] (AMQ-7236) SEV-1 Security vulnerability in spring-expression-4.3.11.RELEASE.jar (spring framework) and xstream-1.4.10.jar
mailing-list
cve.org
访问
cve.org
[activemq-issues] 20190718 [jira] [Updated] (AMQ-7236) SEV-1 Security vulnerability in spring-expression-4.3.11.RELEASE.jar (spring framework) and xstream-1.4.10.jar
mailing-list
cve.org
访问
cve.org
[activemq-issues] 20190826 [jira] [Created] (AMQ-7288) Security Vulnerabilities in ActiveMQ dependent libraries.
mailing-list
cve.org
访问
cve.org
无标题
x_refsource_CONFIRM
cve.org
访问
cve.org
无标题
x_refsource_CONFIRM
cve.org
访问
cve.org
无标题
x_refsource_MISC
cve.org
访问
cve.org
无标题
x_refsource_CONFIRM
cve.org
访问
cve.org
无标题
x_refsource_MISC
cve.org
访问
cve.org
无标题
x_refsource_CONFIRM
cve.org
访问
cve.org
[geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12
mailing-list
cve.org
访问
cve.org
[debian-lts-announce] 20210423 [SECURITY] [DLA 2635-1] libspring-java security update
mailing-list
cve.org
访问
cve.org
无标题
x_refsource_MISC
cve.org
访问
cve.org
CVSS评分详情
9.8
CRITICAL
CVSS向量:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS版本:
3.1
机密性
HIGH
完整性
HIGH
可用性
HIGH
时间信息
发布时间:
2018-04-06 13:00:00
修改时间:
2024-09-16 19:05:05
创建时间:
2025-11-11 15:35:03
更新时间:
2025-11-11 15:53:41
利用信息
暂无可利用代码信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2018-1270 |
2025-11-11 15:19:46 | 2025-11-11 07:35:03 |
| NVD | nvd_CVE-2018-1270 |
2025-11-11 14:55:53 | 2025-11-11 07:43:38 |
| CNNVD | cnnvd_CNNVD-201804-245 |
2025-11-11 15:09:59 | 2025-11-11 07:53:41 |
版本与语言
当前版本:
v3
主要语言:
EN
支持语言:
EN
ZH
安全公告
暂无安全公告信息
变更历史
v3
CNNVD
2025-11-11 15:53:41
vulnerability_type: 未提取 → 代码注入; cnnvd_id: 未提取 → CNNVD-201804-245; data_sources: ['cve', 'nvd'] → ['cnnvd', 'cve', 'nvd']
查看详细变更
- vulnerability_type: 未提取 -> 代码注入
- cnnvd_id: 未提取 -> CNNVD-201804-245
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
v2
NVD
2025-11-11 15:43:38
severity: SeverityLevel.MEDIUM → SeverityLevel.CRITICAL; cvss_score: 未提取 → 9.8; cvss_vector: NOT_EXTRACTED → CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; cvss_version: NOT_EXTRACTED → 3.1; affected_products_count: 1 → 70; data_sources: ['cve'] → ['cve', 'nvd']
查看详细变更
- severity: SeverityLevel.MEDIUM -> SeverityLevel.CRITICAL
- cvss_score: 未提取 -> 9.8
- cvss_vector: NOT_EXTRACTED -> CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- cvss_version: NOT_EXTRACTED -> 3.1
- affected_products_count: 1 -> 70
- data_sources: ['cve'] -> ['cve', 'nvd']