{"id":"CVE-2018-1270","published":"2018-04-06T13:00:00Z","modified":"2026-10-08T21:13:46Z","title":"Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow…","vendor":"Spring by Pivotal","product":"Spring Framework","tier":"core","eol":null,"affectedVersions":[{"vendor":"Spring by Pivotal","product":"Spring Framework","versions":["Versions prior to 5.0.5 and 4.3.15"]}],"description":{"text":"Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.","provenance":"source","from":"CVE.org"},"summary":{"text":"Spring Framework, in versions 5.0 before 5.0.5 and 4.3 before 4.3.15 (plus older unsupported versions), has a code injection flaw in the in-memory STOMP-over-WebSocket broker exposed by the spring-messaging module. An attacker who can craft a message sent to that broker can achieve remote code execution, with the vulnerable application's STOMP over WebSocket endpoint being the entry point.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:16:30Z"},"cvss":null,"epss":{"score":0.77476,"percentile":0.99558,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":1,"pulses":[{"name":"Thor Lite Scan - 10.7.15 - Ubuntu Scan on Archived Files","url":"https://otx.alienvault.com/pulse/664cc3c1938ed0b9abf026a2","created":"2024-05-21"}],"provenance":"machine"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2018:2939","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://www.exploit-db.com/exploits/44796/","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"http://www.securityfocus.com/bid/103696","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://lists.apache.org/thread.html/4ed49b103f64a0cecb38064f26cbf1389afc12124653da2d35166dbe%40%3Cissues.activemq.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/ab825fcade0b49becfa30235b3d54f4a51bb74ea96b6c9adb5d1378c%40%3Cissues.activemq.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369%40%3Cissues.activemq.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1%40%3Cissues.activemq.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","tags":["x_refsource_CONFIRM"]},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","tags":["x_refsource_CONFIRM"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["x_refsource_MISC"]},{"url":"https://pivotal.io/security/cve-2018-1270","tags":["x_refsource_CONFIRM"]},{"url":"https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.springframework:spring-messaging","vulnerableRanges":[">=5.0.0.RELEASE, <5.0.5.RELEASE","<4.3.16.RELEASE"],"patched":["5.0.5.RELEASE","4.3.16.RELEASE"],"from":["GHSA-p5hg-3xm3-gcjg"],"provenance":"source"}],"advisories":[{"id":"GHSA-p5hg-3xm3-gcjg","url":"https://github.com/advisories/GHSA-p5hg-3xm3-gcjg","severity":"CRITICAL","ecosystem":"Maven","package":"org.springframework:spring-messaging","vulnerableRanges":[">=5.0.0.RELEASE, <5.0.5.RELEASE"],"patched":["5.0.5.RELEASE"],"provenance":"source","from":"GHSA"},{"id":"GHSA-p5hg-3xm3-gcjg","url":"https://github.com/advisories/GHSA-p5hg-3xm3-gcjg","severity":"CRITICAL","ecosystem":"Maven","package":"org.springframework:spring-messaging","vulnerableRanges":["<4.3.16.RELEASE"],"patched":["4.3.16.RELEASE"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2018-0646","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-0646","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":2,"earliest":"2018-04-07","earliestUrl":"https://github.com/CaledoniaProject/CVE-2018-1270","repos":[{"name":"CaledoniaProject/CVE-2018-1270","url":"https://github.com/CaledoniaProject/CVE-2018-1270","stars":113,"created":"2018-04-07"},{"name":"Venscor/CVE-2018-1270","url":"https://github.com/Venscor/CVE-2018-1270","stars":0,"created":"2018-12-17"}]},"first":{"date":"2018-04-07","source":"PoC-in-GitHub","url":"https://github.com/CaledoniaProject/CVE-2018-1270"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/44796/","https://www.exploit-db.com/exploits/44796"],"flow":[],"timeline":[{"date":"2018-04-06","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2018-1270","provenance":"source"},{"date":"2018-04-07","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/CaledoniaProject/CVE-2018-1270","provenance":"source"}],"speed":{"daysToPublicExploit":1,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":25.6,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.91,"detail":"percentile 0.9956"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 advisory exploit reference; 2 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-spring-framework-cve-2018-1270","children":[{"from":"CVE-2018-1270","to":"CVE-2018-1275","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"This CVE addresses the partial fix for CVE-2018-1270 in the 4.3.x branch of the Spring Framework.","from":"CVE.org","in":"CVE-2018-1275"},{"kind":"similar","provenance":"machine","score":0.92,"basis":"same product + CWE + description similarity"}]},{"from":"CVE-2018-1270","to":"CVE-2018-1257","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["spring-messaging/src/main/java/org/springframework/messaging/simp/broker/DefaultSubscriptionRegistry.java"],"commits":["https://github.com/spring-projects/spring-framework/commit/246a6db1cad205ca9b6fca00c544ab7443ba202c","https://github.com/spring-projects/spring-framework/commit/ff2228fdaf131d57b5c8c5918ee8d07c6dd9bbac","https://github.com/spring-projects/spring-framework/commit/0009806debb578e884f6dc98bd1f2dc668020021","https://github.com/spring-projects/spring-framework/commit/e0de9126ed8cf25cf141d3e66420da94e350708a"],"basis":"shared function","functions":["DefaultSubscriptionRegistry"]}]}]}}