vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2018-1275

CRITICAL
9.8
CVSS Score
Published: April 11, 2018 at 01:00 PM UTC
Updated: June 17, 2026 at 01:50 AM UTC
20 products affected across 3 vendorsSpring FrameworkApplication Testing SuiteCommunications Diameter Signaling Router

Using Spring Framework by Spring by Pivotal?

Get instant alerts when new vulnerabilities affect Spring Framework - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
CRITICAL9.8
Exploit prediction
EPSS 57%

Description

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack. This CVE addresses the partial fix for CVE-2018-1270 in the 4.3.x branch of the Spring Framework.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Application Testing Suite· Oracledrupal
95%
12.5.0.313.1.0.113.2.0.113.3.0.1
Big Data Discovery· Oracle
95%
1.6.0
Communications Converged Application Server· Oracle
95%
v < 7.0.0.1
Affected range stops below 7.0.0.1, so it looks safe — our inference, not a vendor statement
Communications Diameter Signaling Router· Oracle
95%
v < 8.3
Affected range stops below 8.3, so it looks safe — our inference, not a vendor statement
Communications Performance Intelligence Center· Oracle
95%
v < 10.2.1
Affected range stops below 10.2.1, so it looks safe — our inference, not a vendor statement
Communications Services Gatekeeper· Oracledrupal
95%
v < 6.1.0.4.0
Affected range stops below 6.1.0.4.0, so it looks safe — our inference, not a vendor statement
Goldengate for Big Data· Oracle
95%
12.2.0.112.3.1.112.3.2.1
Health Sciences Information Manager· Oracle
95%
3.0
Healthcare Master Person Index· Oracle
95%
3.04.0
Insurance Calculation Engine· Oracle
95%
10.1.110.210.2.1

References (14)

x_refsource_CONFIRMPatchThird Party Advisory
Source: [email protected]
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
x_refsource_CONFIRMPatchThird Party Advisory
Source: [email protected]
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
VDB Entryx_refsource_BIDThird Party Advisory
Source: [email protected]
http://www.securityfocus.com/bid/103771
VDB Entryx_refsource_SECTRACKThird Party Advisory
Source: [email protected]
http://www.securitytracker.com/id/1041301
Vendor Advisoryx_refsource_REDHATThird Party Advisory
Source: [email protected]
https://access.redhat.com/errata/RHSA-2018:1320
Vendor Advisoryx_refsource_REDHATThird Party Advisory
Source: [email protected]
https://access.redhat.com/errata/RHSA-2018:2939
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/4ed49b103f64a0cecb38064f26cbf1389afc12124653da2d35166dbe%40%3Cissues.activemq.apache.org%3E
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/ab825fcade0b49becfa30235b3d54f4a51bb74ea96b6c9adb5d1378c%40%3Cissues.activemq.apache.org%3E

CVSS

9.8CRITICAL[email protected]
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-94CWE-358

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card