Pivotal Spring Framework CVE-2018-1275 Incomplete Fix Remote Code Execution Vulnerability

Bugtraq ID:	103771
Class:	Input Validation Error
CVE:	CVE-2018-1275
Remote:	Yes
Local:	No
Published:	Apr 13 2018 12:00AM
Updated:	Jul 17 2019 07:00AM
Credit:	rwx, Christoph Dreis, and 0c0c0f.
Vulnerable:	Pivotal Spring Framework 5.0.4 Pivotal Spring Framework 5.0.3 Pivotal Spring Framework 5.0.2 Pivotal Spring Framework 5.0.1 Pivotal Spring Framework 5.0 Pivotal Spring Framework 4.3.15 Pivotal Spring Framework 4.3.14 Pivotal Spring Framework 4.3 Oracle Tape Library ACSLS 8.4 Oracle SOA Suite 12.2.1.3.0 Oracle SOA Suite 12.1.3.0.0 Oracle Retail Predictive Application Server 16.0 Oracle Retail Predictive Application Server 15.0 Oracle Retail Predictive Application Server 14.1 Oracle Retail Predictive Application Server 14.0 Oracle Retail Order Broker 5.2 Oracle Retail Order Broker 5.1 Oracle Retail Order Broker 16.0 Oracle Retail Order Broker 15.0 Oracle Retail Open Commerce Platform 6.0.1 Oracle Retail Open Commerce Platform 6.0 Oracle Retail Open Commerce Platform 5.3 Oracle Primavera Gateway 17.12 Oracle Primavera Gateway 16.2 Oracle Primavera Gateway 15.2 Oracle Insurance Rules Palette 11.1 Oracle Insurance Rules Palette 11.0 Oracle Insurance Rules Palette 10.2.0 Oracle Insurance Rules Palette 10.1 Oracle Insurance Rules Palette 10.0 Oracle Insurance Calculation Engine 10.2.1 Oracle Insurance Calculation Engine 10.1.1 Oracle GoldenGate for Big Data 12.3.2.1 Oracle GoldenGate for Big Data 12.3.1.1 Oracle GoldenGate for Big Data 12.2.0.1 Oracle GoldenGate Application Adapters 12.3.2.1.1 Oracle FLEXCUBE Investor Servicing 14.0 Oracle FLEXCUBE Investor Servicing 12.4 Oracle FLEXCUBE Investor Servicing 12.3 Oracle FLEXCUBE Investor Servicing 12.1 Oracle FLEXCUBE Investor Servicing 12.0.4 Oracle Communications WebRTC Session Controller 7.1 Oracle Communications WebRTC Session Controller 7.0 Oracle Communications WebRTC Session Controller 0 Oracle Communications Service Broker 6.0 Oracle Communications Online Mediation Controller 6.1 Oracle Communications Converged Application Server Service Controller 6.1 Oracle Communications Converged Application Server - Service Controller 6.1 Oracle Communications Converged Application Server - Service Controller 6.0 Oracle Big Data Discovery 1.6
Not Vulnerable:	Pivotal Spring Framework 5.0.5 Pivotal Spring Framework 4.3.16 Oracle Communications WebRTC Session Controller 7.2

Pivotal Spring Framework CVE-2018-1275 Incomplete Fix Remote Code Execution Vulnerability

Pivotal Spring Framework is prone to remote code-execution vulnerability.

Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the affected application. Failed exploits will result in denial-of-service conditions.

Spring Framework 5.0.x through 5.0.4 and 4.3.x through 4.3.15 are vulnerable; prior unsupported versions may also be affected.

NOTE: This issue is the result of an incomplete fix for the issue described in BID 103696 (Pivotal Spring Framework CVE-2018-1270 Remote Code Execution Vulnerability).

Pivotal Spring Framework CVE-2018-1275 Incomplete Fix Remote Code Execution Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Pivotal Spring Framework CVE-2018-1275 Incomplete Fix Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Pivotal Spring Framework CVE-2018-1275 Incomplete Fix Remote Code Execution Vulnerability

References:

• Pivotal Homepage (Pivotal)
  
• CVE-2018-1275: Address partial fix for CVE-2018-1270 (Pivotal)
  
• Oracle Critical Patch Update Advisory - January 2019 (Oracle)
  
• Oracle Critical Patch Update Advisory - July 2019 (Oracle)
  
• Oracle Critical Patch Update Advisory - October 2018 (Oracle)