CVE-2018-1275

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack. This CVE addresses the partial fix for CVE-2018-1270 in the 4.3.x branch of the Spring Framework.

• Oracle Application Testing Suite

  APP
  Oracle
  12.5.0.313.1.0.113.2.0.113.3.0.1

• Oracle Big Data Discovery

  APP
  Oracle
  1.6.0

• Oracle Communications Converged Application Server

  APP
  Oracle
  < 7.0.0.1

• Oracle Communications Diameter Signaling Router

  APP
  Oracle
  < 8.3

• Oracle Communications Performance Intelligence Center

  APP
  Oracle
  < 10.2.1

• Oracle Communications Services Gatekeeper

  APP
  Oracle
  < 6.1.0.4.0

• Oracle Goldengate For Big Data

  APP
  Oracle
  12.2.0.112.3.1.112.3.2.1

• Oracle Healthcare Master Person Index

  APP
  Oracle
  3.04.0

• Oracle Health Sciences Information Manager

  APP
  Oracle
  3.0

• Oracle Insurance Calculation Engine

  APP
  Oracle
  10.1.110.210.2.1

• Oracle Insurance Rules Palette

  APP
  Oracle
  10.010.110.211.011.1

• Oracle Primavera Gateway

  APP
  Oracle
  15.216.217.12

• Oracle Retail Customer Insights

  APP
  Oracle
  15.016.0

• Oracle Retail Open Commerce Platform

  APP
  Oracle
  5.3.06.0.06.0.1

• Oracle Retail Order Broker

  APP
  Oracle
  15.016.05.15.2

• Oracle Retail Predictive Application Server

  APP
  Oracle
  14.014.115.016.0

• Oracle Service Architecture Leveraging Tuxedo

  APP
  Oracle
  12.1.3.0.012.2.2.0.0

• Oracle Tape Library Acsls

  APP
  Oracle
  8.4

• VMware Spring Framework

  APP
  Vmware
  4.3.0 – 4.3.16 (bez)5.0.0 – 5.0.5 (bez)