{"id":"CVE-2018-1275","published":"2018-04-11T13:00:00Z","modified":"2024-09-17T02:43:01Z","title":"Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow…","vendor":"Spring by Pivotal","product":"Spring Framework","tier":"core","eol":null,"affectedVersions":[{"vendor":"Spring by Pivotal","product":"Spring Framework","versions":["Versions prior to 5.0.5 and 4.3.16"]}],"description":{"text":"Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack. This CVE addresses the partial fix for CVE-2018-1270 in the 4.3.x branch of the Spring Framework.","provenance":"source","from":"CVE.org"},"summary":{"text":"Spring Framework (versions before 5.0.5 in the 5.0 branch, before 4.3.16 in the 4.3 branch, and older unsupported versions) has a code injection flaw in the spring-messaging module's in-memory STOMP broker, which serves STOMP over WebSocket endpoints. An attacker who can send a crafted message to that broker can achieve remote code execution.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:23:05Z"},"cvss":null,"epss":{"score":0.57414,"percentile":0.99075,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":1,"pulses":[{"name":"Thor Lite Scan - 10.7.15 - Ubuntu Scan on Archived Files","url":"https://otx.alienvault.com/pulse/664cc3c1938ed0b9abf026a2","created":"2024-05-21"}],"provenance":"machine"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"http://www.securitytracker.com/id/1041301","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2939","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1320","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.securityfocus.com/bid/103771","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://lists.apache.org/thread.html/4ed49b103f64a0cecb38064f26cbf1389afc12124653da2d35166dbe%40%3Cissues.activemq.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/ab825fcade0b49becfa30235b3d54f4a51bb74ea96b6c9adb5d1378c%40%3Cissues.activemq.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369%40%3Cissues.activemq.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","tags":["x_refsource_CONFIRM"]},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","tags":["x_refsource_CONFIRM"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["x_refsource_MISC"]},{"url":"https://pivotal.io/security/cve-2018-1275","tags":["x_refsource_CONFIRM"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.springframework:spring-messaging","vulnerableRanges":["<4.3.16.RELEASE",">=5.0.0.RELEASE, <5.0.5.RELEASE"],"patched":["4.3.16.RELEASE","5.0.5.RELEASE"],"from":["GHSA-3rmv-2pg5-xvqj"],"provenance":"source"}],"advisories":[{"id":"GHSA-3rmv-2pg5-xvqj","url":"https://github.com/advisories/GHSA-3rmv-2pg5-xvqj","severity":"CRITICAL","ecosystem":"Maven","package":"org.springframework:spring-messaging","vulnerableRanges":["<4.3.16.RELEASE"],"patched":["4.3.16.RELEASE"],"provenance":"source","from":"GHSA"},{"id":"GHSA-3rmv-2pg5-xvqj","url":"https://github.com/advisories/GHSA-3rmv-2pg5-xvqj","severity":"CRITICAL","ecosystem":"Maven","package":"org.springframework:spring-messaging","vulnerableRanges":[">=5.0.0.RELEASE, <5.0.5.RELEASE"],"patched":["5.0.5.RELEASE"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2018-0490","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-0490","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2018-04-11","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2018-1275","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":20.5,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.82,"detail":"percentile 0.9908"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-spring-framework-cve-2018-1270","parents":[{"from":"CVE-2018-1270","to":"CVE-2018-1275","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"This CVE addresses the partial fix for CVE-2018-1270 in the 4.3.x branch of the Spring Framework.","from":"CVE.org","in":"CVE-2018-1275"},{"kind":"similar","provenance":"machine","score":0.92,"basis":"same product + CWE + description similarity"}]}],"children":[{"from":"CVE-2018-1275","to":"CVE-2018-1257","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["spring-messaging/src/main/java/org/springframework/messaging/simp/broker/DefaultSubscriptionRegistry.java"],"commits":["https://github.com/spring-projects/spring-framework/commit/246a6db1cad205ca9b6fca00c544ab7443ba202c","https://github.com/spring-projects/spring-framework/commit/ff2228fdaf131d57b5c8c5918ee8d07c6dd9bbac","https://github.com/spring-projects/spring-framework/commit/0009806debb578e884f6dc98bd1f2dc668020021","https://github.com/spring-projects/spring-framework/commit/e0de9126ed8cf25cf141d3e66420da94e350708a"],"basis":"shared function","functions":["DefaultSubscriptionRegistry"]}]}]}}