CVE-2018-1270 Public exploit EPSS 77.5%

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow…

Spring by Pivotal · Spring Framework

Summary

Spring Framework, in versions 5.0 before 5.0.5 and 4.3 before 4.3.15 (plus older unsupported versions), has a code injection flaw in the in-memory STOMP-over-WebSocket broker exposed by the spring-messaging module. An attacker who can craft a message sent to that broker can achieve remote code execution, with the vulnerable application's STOMP over WebSocket endpoint being the entry point.

Official description · CVE.org

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.

Breakdown

25.6 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 0/15

Public exploit code (PoC-in-GitHub) appeared 1 day after disclosure. No confirmed exploitation is recorded.

Disclosed6 Apr 2018day 0
Public exploit codePoC-in-GitHub7 Apr 2018+1 day

See the family tree

A fix was bypassed or incomplete once over 5 weeks.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

This CVECVE-2018-1270Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3…6 Apr 2018
incomplete fixHigh
Why these are linked:
- Stated in the CVE textThis CVE addresses the partial fix for CVE-2018-1270 in the 4.3.x branch of the Spring Framework.
- Similar weakness in the same product (machine-matched)same product + CWE + description similarity
CVE-2018-1275Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3…11 Apr 2018
relatedMedium
Why these are linked:
- Same code patched: DefaultSubscriptionRegistry.java (machine-matched)Functions: DefaultSubscriptionRegistrycommit 246a6db commit ff2228f commit 0009806 commit e0de912
CVE-2018-1257Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x…11 May 2018

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.springframework:spring-messaging.

Mavenorg.springframework:spring-messagingGHSA-p5hg-3xm3-gcjg

Upgrade to 5.0.5.RELEASE or later

Fixes this CVE and 1 other known vulnerability in this package (CVE-2018-1275).

Set the version to 5.0.5.RELEASE or later in your pom.xml or build.gradle.

The first fix for CVE-2018-1270.

Affected versions, by release line

If you run	Upgrade to
5.0.0.RELEASE up to 5.0.5.RELEASE	5.0.5.RELEASE
All versions before 4.3.16.RELEASE	4.3.16.RELEASE

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 1 community threat pulse (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Thor Lite Scan - 10.7.15 - Ubuntu Scan on Archived Files21 May 2024

References

16 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2018-0646

Public exploitAdvisories link exploit code.

, 30 Oct 2026

77.5%Top 0.44%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.56%).

No CVSS score published.

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9956 19.9/20

Threat reports0 reports 0.0/10

Public exploit code1 NVD reference tagged Exploit; 1 advisory exploit reference; 2 PoC-in-GitHub repos 5.0/5

Mentioned in OTX pulses1 pulse 0.7/3

CVSS base scoreno CVSS 0.0/7

End-of-life productsupported or unknown 0.0

Total25.6

Record

Published: 6 Apr 2018
Modified: 8 Oct 2026
: CWE-94 Improper Control of Generation of Code
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Am I affected? What do I upgrade to?

Affected versions, by release line

What security researchers reported

Also mentioned in 1 community threat pulse (AlienVault OTX)

References

vendor-advisory 1

exploit 1

vdb-entry 1

mailing-list 6

x_refsource_CONFIRM 4

x_refsource_MISC 3

techniques