VDB

CVE-2018-1270

CVE-2018-1270 PUBLISHED CVSS 9.800000190734863 CRITICAL

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.

EPSS 77.48% · 99.5th percentile

Risk Scores

CVSS 3.0
9.800000190734863
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
77.48%
99.5th percentile

Affected Products

VendorProductVersions
Ubuntu:18.04:LTSlibspring-java0, 4.3.11-1, 4.3.12-1

Timeline

  • Apr 5, 2018 CVE Published
  • May 29, 2018 PoC Published
  • Apr 14, 2021 EPSS Score
  • Jun 23, 2021 EPSS Score
  • Oct 21, 2021 EPSS Score
  • Dec 28, 2021 EPSS Score
  • Feb 28, 2022 EPSS Score
  • May 2, 2022 EPSS Score
  • Sep 6, 2022 EPSS Score
  • Jan 1, 2023 EPSS Score
  • Mar 7, 2023 EPSS Score
  • Mar 31, 2023 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›