Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack. This CVE addresses the partial fix for CVE-2018-1270 in the 4.3.x branch of the Spring Framework.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOracle Application Testing Suite
APPOracle12.5.0.313.1.0.113.2.0.113.3.0.1Oracle Big Data Discovery
APPOracle1.6.0Oracle Communications Converged Application Server
APPOracle< 7.0.0.1Oracle Communications Diameter Signaling Router
APPOracle< 8.3Oracle Communications Performance Intelligence Center
APPOracle< 10.2.1Oracle Communications Services Gatekeeper
APPOracle< 6.1.0.4.0Oracle Goldengate For Big Data
APPOracle12.2.0.112.3.1.112.3.2.1Oracle Healthcare Master Person Index
APPOracle3.04.0Oracle Health Sciences Information Manager
APPOracle3.0Oracle Insurance Calculation Engine
APPOracle10.1.110.210.2.1Oracle Insurance Rules Palette
APPOracle10.010.110.211.011.1Oracle Primavera Gateway
APPOracle15.216.217.12Oracle Retail Customer Insights
APPOracle15.016.0Oracle Retail Open Commerce Platform
APPOracle5.3.06.0.06.0.1Oracle Retail Order Broker
APPOracle15.016.05.15.2Oracle Retail Predictive Application Server
APPOracle14.014.115.016.0Oracle Service Architecture Leveraging Tuxedo
APPOracle12.1.3.0.012.2.2.0.0Oracle Tape Library Acsls
APPOracle8.4VMware Spring Framework
APPVmware4.3.0 – 4.3.16 (excl.)5.0.0 – 5.0.5 (excl.)
Related vulnerabilities
Spring4Shell — RCE przez data binding w Spring MVC/WebFlux na JDK 9+
RCE przez deserializację w Oracle Coherence via protokół T3
RCE w Oracle WebLogic Server — przejęcie serwera bez uwierzytelnienia
RCE w PHPUnit — wykonanie kodu PHP przez eval-stdin.php
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) wi...