CVE-2018-15756

Common vulnerabilities & exposures (CVE)

CVE database CVE database blogpost Release & EoL database

Published at: - 19-10-2018 12:29

Last modified: - 13-05-2022 10:56

Total changes: - 7

Description

Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Low

Attack complexity

Network

Attack vector

High

Availability

None

Confidentiality

None

Integrity

None

Privileges required

Unchanged

Scope

None

User interaction

7.5

Base score

3.9

3.6

Exploitability score

Impact score

Verification logic

vendor=vmware AND product=spring_framework AND versionStartIncluding=4.2.0 AND versionEndExcluding=4.3.20

vendor=vmware AND product=spring_framework AND versionStartIncluding=5.0.0 AND versionEndExcluding=5.0.10

vendor=vmware AND product=spring_framework AND version=5.1.0

vendor=oracle AND product=flexcube_private_banking AND version=12.1.0

vendor=oracle AND product=insurance_policy_administration_j2ee AND version=10.2.0

vendor=oracle AND product=retail_xstore_point_of_service AND version=7.1

vendor=oracle AND product=weblogic_server AND version=12.1.3.0.0

vendor=oracle AND product=retail_invoice_matching AND version=13.0

vendor=oracle AND product=flexcube_private_banking AND version=12.0.1

vendor=oracle AND product=primavera_gateway AND version=16.2

vendor=oracle AND product=primavera_gateway AND version=15.2

vendor=oracle AND product=retail_invoice_matching AND version=12.0

vendor=oracle AND product=flexcube_private_banking AND version=12.0.3

vendor=oracle AND product=communications_unified_inventory_management AND version=7.3

vendor=oracle AND product=endeca_information_discovery_integrator AND version=3.2.0

vendor=oracle AND product=enterprise_manager_ops_center AND version=12.3.3

vendor=oracle AND product=healthcare_master_person_index AND version=3.0

vendor=oracle AND product=insurance_calculation_engine AND version=10.2

vendor=oracle AND product=insurance_rules_palette AND version=10.0

vendor=oracle AND product=insurance_rules_palette AND version=10.1

vendor=oracle AND product=insurance_rules_palette AND version=10.2

vendor=oracle AND product=insurance_rules_palette AND version=10.2.0

vendor=oracle AND product=insurance_rules_palette AND version=11.0

vendor=oracle AND product=retail_integration_bus AND version=15.0

vendor=oracle AND product=retail_order_broker AND version=5.1

vendor=oracle AND product=retail_order_broker AND version=5.2

vendor=oracle AND product=retail_order_broker AND version=15.0

vendor=oracle AND product=retail_order_broker AND version=16.0

vendor=oracle AND product=retail_predictive_application_server AND version=16.0

vendor=oracle AND product=retail_service_backbone AND version=15.0

vendor=oracle AND product=webcenter_sites AND version=12.2.1.3.0

vendor=oracle AND product=weblogic_server AND version=10.3.6.0.0

vendor=oracle AND product=weblogic_server AND version=12.2.1.3.0

vendor=oracle AND product=agile_plm AND version=9.3.3

vendor=oracle AND product=agile_plm AND version=9.3.4

vendor=oracle AND product=agile_plm AND version=9.3.5

vendor=oracle AND product=agile_plm AND version=9.3.6

vendor=oracle AND product=communications_converged_application_server_-_service_controller AND version=6.1

vendor=oracle AND product=communications_element_manager AND version=8.1.1

vendor=oracle AND product=communications_element_manager AND version=8.2.0

vendor=oracle AND product=communications_element_manager AND version=8.2.1

vendor=oracle AND product=communications_online_mediation_controller AND version=6.1

vendor=oracle AND product=communications_session_report_manager AND version=8.1.1

vendor=oracle AND product=communications_session_report_manager AND version=8.2.0

vendor=oracle AND product=communications_session_report_manager AND version=8.2.1

vendor=oracle AND product=communications_session_route_manager AND version=8.1.1

vendor=oracle AND product=communications_session_route_manager AND version=8.2.0

vendor=oracle AND product=communications_session_route_manager AND version=8.2.1

vendor=oracle AND product=communications_unified_inventory_management AND version=7.4.0

vendor=oracle AND product=enterprise_manager_for_fusion_applications AND version=13.3.0.0

vendor=oracle AND product=goldengate_application_adapters AND version=12.3.2.1.0

vendor=oracle AND product=identity_manager_connector AND version=9.0

vendor=oracle AND product=insurance_policy_administration_j2ee AND version=10.0

vendor=oracle AND product=insurance_policy_administration_j2ee AND version=10.2

vendor=oracle AND product=mysql_enterprise_monitor AND versionEndIncluding=4.0.12

vendor=oracle AND product=mysql_enterprise_monitor AND versionEndIncluding=8.0.20 AND versionStartIncluding=8.0.0

vendor=oracle AND product=primavera_gateway AND version=17.12

vendor=oracle AND product=rapid_planning AND version=12.1

vendor=oracle AND product=rapid_planning AND version=12.2

vendor=oracle AND product=retail_assortment_planning AND version=15.0

vendor=oracle AND product=retail_assortment_planning AND version=16.0

vendor=oracle AND product=retail_clearance_optimization_engine AND version=14.0.5

vendor=oracle AND product=retail_financial_integration AND version=14.0

vendor=oracle AND product=retail_financial_integration AND version=14.1

vendor=oracle AND product=retail_financial_integration AND version=15.0

vendor=oracle AND product=retail_financial_integration AND version=16.0

vendor=oracle AND product=retail_integration_bus AND version=16.0

vendor=oracle AND product=retail_invoice_matching AND version=13.1

vendor=oracle AND product=retail_invoice_matching AND version=13.2

vendor=oracle AND product=retail_invoice_matching AND version=14.0

vendor=oracle AND product=retail_invoice_matching AND version=14.1

vendor=oracle AND product=retail_predictive_application_server AND version=15.0.3

vendor=oracle AND product=weblogic_server AND version=12.2.1.4.0

vendor=oracle AND product=communications_brm_-_elastic_charging_engine AND version=11.3

vendor=oracle AND product=communications_brm_-_elastic_charging_engine AND version=12.0

vendor=oracle AND product=communications_converged_application_server_-_service_controller AND version=6.0

vendor=oracle AND product=communications_diameter_signaling_router AND version=8.0.0

vendor=oracle AND product=communications_diameter_signaling_router AND version=8.1

vendor=oracle AND product=communications_diameter_signaling_router AND version=8.2

vendor=oracle AND product=communications_diameter_signaling_router AND version=8.2.1

vendor=oracle AND product=communications_session_report_manager AND version=8.0.0

vendor=oracle AND product=communications_session_report_manager AND version=8.1.0

vendor=oracle AND product=communications_session_route_manager AND version=8.0.0

vendor=oracle AND product=communications_session_route_manager AND version=8.1.0

vendor=oracle AND product=financial_services_analytical_applications_infrastructure AND versionEndIncluding=8.0.8 AND versionStartIncluding=8.0.2

vendor=oracle AND product=healthcare_master_person_index AND version=4.0.2

vendor=oracle AND product=insurance_calculation_engine AND version=9.7

vendor=oracle AND product=insurance_calculation_engine AND version=10.0

vendor=oracle AND product=insurance_calculation_engine AND version=10.1

vendor=oracle AND product=insurance_policy_administration_j2ee AND version=10.1

vendor=oracle AND product=insurance_policy_administration_j2ee AND version=10.2.4

vendor=oracle AND product=insurance_policy_administration_j2ee AND version=11.0

vendor=oracle AND product=insurance_policy_administration_j2ee AND version=11.1.0

vendor=oracle AND product=insurance_policy_administration_j2ee AND version=11.2.0

vendor=oracle AND product=insurance_rules_palette AND version=10.2.4

vendor=oracle AND product=insurance_rules_palette AND version=11.0.2

vendor=oracle AND product=insurance_rules_palette AND version=11.1.0

vendor=oracle AND product=insurance_rules_palette AND version=11.2.0

vendor=oracle AND product=primavera_analytics AND version=18.8

vendor=oracle AND product=primavera_gateway AND version=18.8.0

vendor=oracle AND product=retail_advanced_inventory_planning AND version=15.0

vendor=oracle AND product=retail_integration_bus AND version=15.0.3

vendor=oracle AND product=retail_integration_bus AND version=16.0.3

vendor=oracle AND product=retail_markdown_optimization AND version=13.4.4

vendor=oracle AND product=retail_predictive_application_server AND version=14.0.3

vendor=oracle AND product=retail_predictive_application_server AND version=14.0.3.26

vendor=oracle AND product=retail_predictive_application_server AND version=14.1.3

vendor=oracle AND product=retail_predictive_application_server AND version=14.1.3.37

vendor=oracle AND product=retail_predictive_application_server AND version=15.0.3.100

vendor=oracle AND product=retail_predictive_application_server AND version=16.0.3

vendor=oracle AND product=retail_service_backbone AND version=16.0

vendor=oracle AND product=retail_service_backbone AND version=16.0.1

vendor=oracle AND product=tape_library_acsls AND version=8.5

vendor=Debian AND product=debian_linux AND version=9.0

Reference

https://pivotal.io/security/cve-2018-15756
105703-Third Party Advisory, URL Repurposed, VDB Entry
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
[activemq-issues] 20190529 [jira] [Created] (ARTEMIS-2363) spring-core-5.0.1.RELEASE.jar vulnerable to CVE-2018-15756-Issue Tracking, Mailing List, Third Party Advisory
[activemq-issues] 20190529 [jira] [Updated] (ARTEMIS-2363) spring-core-5.0.1.RELEASE.jar vulnerable to CVE-2018-15756-Issue Tracking, Mailing List, Third Party Advisory
[activemq-issues] 20190529 [jira] [Commented] (ARTEMIS-2363) spring-core-5.0.1.RELEASE.jar vulnerable to CVE-2018-15756-Issue Tracking, Mailing List, Third Party Advisory
[activemq-issues] 20190626 [jira] [Assigned] (ARTEMIS-2363) spring-core-5.0.1.RELEASE.jar vulnerable to CVE-2018-15756-Issue Tracking, Mailing List, Third Party Advisory
[activemq-issues] 20190626 [jira] [Work logged] (ARTEMIS-2363) spring-core-5.0.1.RELEASE.jar vulnerable to CVE-2018-15756-Issue Tracking, Mailing List, Third Party Advisory
[activemq-issues] 20190716 [jira] [Commented] (ARTEMIS-2363) spring-core-5.0.1.RELEASE.jar vulnerable to CVE-2018-15756-Issue Tracking, Mailing List, Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
[activemq-issues] 20190826 [jira] [Closed] (ARTEMIS-2363) spring-core-5.0.1.RELEASE.jar vulnerable to CVE-2018-15756-Issue Tracking, Mailing List, Third Party Advisory
[activemq-issues] 20190826 [jira] [Reopened] (ARTEMIS-2363) spring-core-5.0.1.RELEASE.jar vulnerable to CVE-2018-15756-Issue Tracking, Mailing List, Third Party Advisory
[activemq-issues] 20190826 [jira] [Updated] (ARTEMIS-2363) spring-core-5.0.1.RELEASE.jar vulnerable to CVE-2018-15756-Issue Tracking, Mailing List, Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
https://www.oracle.com/security-alerts/cpujan2020.html
N/A-Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html
https://www.oracle.com/security-alerts/cpujan2021.html
[debian-lts-announce] 20210423 [SECURITY] [DLA 2635-1] libspring-java security update-Mailing List, Third Party Advisory
N/A-Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html

Keywords

CVE-2018-15756

Common vulnerabilities & exposures (CVE)

Description

Common Vulnerability Scoring System (CVSS)

Verification logic

Reference

NVD

CVE-2018-15756

CVE

Common vulnerabilities & exposures

CVSS

Common vulnerability scoring system

Security

Vulnerabilities

Exposures