PT-2018-1390

Name of the Vulnerable Software and Affected Versions Spring Framework versions 5.0 prior to 5.0.5 Spring Framework versions 4.3 prior to 4.3.16 Spring Framework older unsupported versions Description The issue allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory...

CVE-2018-1275: Improper Control of Generation of Code

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user or attacker can craft a message to...

Remote Code Execution Vulnerability in Spring Framework spring-messaging Module

Spring Framework is the United States Pivotal Software's set of open source Java, Java EE application framework. The framework helps developers build high-quality applications . A remote code execution vulnerability exists in the Spring Framework spring-messaging module. An attacker can exploit t...

BSA-2018-583

Security Advisory ID : BSA-2018-583 Component : Spring-framework Revision : 1.0: Final Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocketendpoints with a simple, in-memory STOMP broker...

Exploit for Code Injection in Vmware Spring_Framework

PoC exploit for CVE-2018-1270, a Spring messaging STOMP protocol...

CVE-2018-1270

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user or attacker can craft a message to...

DEBIAN-CVE-2018-1270

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user or attacker can craft a message to...

UBUNTU-CVE-2018-1270

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user or attacker can craft a message to...

CVE-2018-1270

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user or attacker can craft a message to...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (3.4.0), ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=3.1.0, <=3.4.0) +121 more potentially affected by CVE-2018-1270 via org.springframework:spring-messaging (>=5.0.0.release, <=5.0.4.release)

org.springframework:spring-messaging MAVEN version =5.0.0.release, =3.1.0, =0.2.0, =0.1.0-rc1, =3.0.0-alpha.1, =3.0.1 and more Source cves: CVE-2018-1270 Source advisory: MEND:CVE-2018-1270...

at.chrl:chrl-jms (1.1.0), at.researchstudio.sat:won-core (>=0.2, <=0.3) +1867 more potentially affected by CVE-2018-1270 via org.springframework:spring-messaging (>=4.0.1.release, <=4.3.15.release)

org.springframework:spring-messaging MAVEN version =4.0.1.release, =0.2, =0.2, =0.2, =0.2, =0.3 - at.researchstudio.sat:won-node 0.3 - at.researchstudio.sat:won-node-webapp 0.3 - at.researchstudio.sat:won-owner 0.3 - at.researchstudio.sat:won-owner-webapp 0.3 and more Source cves: CVE-2018-1270...

Remote Code Execution (RCE)

spring-messaging is susceptible to remote code execution RCE attack. The vulnerability exists through the simple STOMP broker that exposes a weakness to malicious users who can perform a RCE attack through the STORM payload...

CVE-2018-1270: Improper Control of Generation of Code

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user or attacker can craft a message to...

Solaris 10 (x86) : 137205-38

Messaging Server 64bit 7.0.5.38.0x86: core patch. Date this patch was last updated by Sun : Dec/10/16 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; ...

Solaris 10 (sparc) : 137204-35

Messaging Server 64bit 7.0.5.35.0: core patch. Date this patch was last updated by Sun : May/30/15 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if...

Solaris 10 (sparc) : 137204-33

Messaging Server 64bit 7.0.5.33.0: core patch. Date this patch was last updated by Sun : Sep/15/14 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if...

Solaris 10 (x86) : 137205-37

Messaging Server 64bit 7.0.5.37.0x86: core patch. Date this patch was last updated by Sun : Feb/15/16 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; ...

Solaris 10 (x86) : 137205-33

Messaging Server 64bit 7.0.5.33.0x86: core patch. Date this patch was last updated by Sun : Sep/15/14 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; ...

Solaris 10 (sparc) : 137204-36

Messaging Server 64bit 7.0.5.36.0: core patch. Date this patch was last updated by Sun : Oct/31/15 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if...

Solaris 10 (x86) : 137205-31

Messaging Server 64bit 7.0.5.31.0x86: core patch. Date this patch was last updated by Sun : Jun/03/14 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; ...