{"id":"CVE-2018-11087","published":"2018-09-14T20:00:00Z","modified":"2024-09-17T03:58:41Z","title":"TLS validation error","vendor":"Pivotal","product":"Spring AMQP","tier":"core","eol":null,"affectedVersions":[{"vendor":"Pivotal","product":"Spring AMQP","versions":[">= 1.x, < 1.7.10",">= 2.x, < 2.0.6"]}],"description":{"text":"Pivotal Spring AMQP, 1.x versions prior to 1.7.10 and 2.x versions prior to 2.0.6, expose a man-in-the-middle vulnerability due to lack of hostname validation. A malicious user that has the ability to intercept traffic would be able to view data in transit.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":null,"epss":{"score":0.01234,"percentile":0.68928,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://pivotal.io/security/cve-2018-11087","tags":["x_refsource_CONFIRM"]}],"techniques":[{"id":"T1557","name":"Adversary-in-the-Middle","tactics":["collection","credential-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 2)","mappingType":"primary_impact","evidence":[],"confidence":"high"}],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.springframework.amqp:spring-amqp","vulnerableRanges":[">=2.0.0, <2.0.6","<1.7.10"],"patched":["2.0.6","1.7.10"],"from":["GHSA-w4g2-9hj6-5472"],"provenance":"source"},{"ecosystem":"Maven","package":"com.rabbitmq:amqp-client","vulnerableRanges":["<4.8.0",">=5.0.0, <5.4.0"],"patched":["4.8.0","5.4.0"],"from":["GHSA-w4g2-9hj6-5472"],"provenance":"source"}],"advisories":[{"id":"GHSA-w4g2-9hj6-5472","url":"https://github.com/advisories/GHSA-w4g2-9hj6-5472","severity":"MODERATE","ecosystem":"Maven","package":"org.springframework.amqp:spring-amqp","vulnerableRanges":[">=2.0.0, <2.0.6"],"patched":["2.0.6"],"provenance":"source","from":"GHSA"},{"id":"GHSA-w4g2-9hj6-5472","url":"https://github.com/advisories/GHSA-w4g2-9hj6-5472","severity":"MODERATE","ecosystem":"Maven","package":"org.springframework.amqp:spring-amqp","vulnerableRanges":["<1.7.10"],"patched":["1.7.10"],"provenance":"source","from":"GHSA"},{"id":"GHSA-w4g2-9hj6-5472","url":"https://github.com/advisories/GHSA-w4g2-9hj6-5472","severity":"MODERATE","ecosystem":"Maven","package":"com.rabbitmq:amqp-client","vulnerableRanges":["<4.8.0"],"patched":["4.8.0"],"provenance":"source","from":"GHSA"},{"id":"GHSA-w4g2-9hj6-5472","url":"https://github.com/advisories/GHSA-w4g2-9hj6-5472","severity":"MODERATE","ecosystem":"Maven","package":"com.rabbitmq:amqp-client","vulnerableRanges":[">=5.0.0, <5.4.0"],"patched":["5.4.0"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2018-0705","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-0705","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"primary","techniques":["T1557"],"provenance":"source"}],"timeline":[{"date":"2018-09-14","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2018-11087","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":13.8,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":13.79,"detail":"percentile 0.6893"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2016-2173","published":"2017-04-21","fixed":"1.5.5","kev":false},{"cve":"CVE-2017-8045","published":"2017-11-27","fixed":"1.7.4","kev":false,"link":{"from":"CVE-2017-8045","to":"CVE-2018-11087","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.springframework.amqp:spring-amqp","fromFixed":"1.7.4","toFixed":"1.7.10","daysApart":291}]}},{"cve":"CVE-2018-11087","published":"2018-09-14","fixed":"2.0.6","kev":false},{"cve":"CVE-2021-22095","published":"2021-11-30","fixed":"2.3.11","kev":false},{"cve":"CVE-2021-22097","published":"2021-10-28","fixed":"2.3.11","kev":false},{"cve":"CVE-2026-41701","published":"2026-06-09","fixed":"4.0.4","kev":false}],"package":"Maven:org.springframework.amqp:spring-amqp"}}