CVE-2018-1271
Path Traversal in org.springframework:spring-core
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.
- Record
CVE-2018-1271- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.
- Record
CVE-2018-1271- Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2018-0599 No score
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.
- Record
EUVD-2018-0599- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g8hw-794c-4j9g
Path Traversal in org.springframework:spring-core
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.
- Record
GHSA-g8hw-794c-4j9g- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.
- Record
CVE-2018-1271- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-g8hw-794c-4j9g
Path Traversal in org.springframework:spring-core
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.
- Record
GHSA-g8hw-794c-4j9g- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
Show 10 moreShow less
OSVCLSA-2025-1760313981 No score
TuxCare security update for org.springframework (25 CVEs)
TuxCare rebuilt 6 org.springframework packages to address 25 CVEs. Fixed in 4.0.0.RELEASE-tuxcare.1.
- Record
CLSA-2025-1760313981- Updated
- 2026-11-02
OSVCLSA-2025-1760313986 No score
TuxCare security update for org.springframework (29 CVEs)
TuxCare rebuilt 7 org.springframework packages to address 29 CVEs. Fixed in 3.1.1.RELEASE-tuxcare.1.
- Record
CLSA-2025-1760313986- Updated
- 2026-11-02
OSVCLSA-2026-1774311642 No score
TuxCare security update for org.springframework (8 CVEs)
TuxCare rebuilt 3 org.springframework packages to address 8 CVEs. Fixed in 4.1.7.RELEASE-tuxcare.2.
- Record
CLSA-2026-1774311642- Updated
- 2026-11-02
OSVCLSA-2026-1777509606 No score
TuxCare security update for org.springframework (8 CVEs)
TuxCare rebuilt 4 org.springframework packages to address 8 CVEs. Fixed in 4.2.9.RELEASE-tuxcare.1.
- Record
CLSA-2026-1777509606- Updated
- 2026-11-02
OSVCLSA-2026-1782867606 No score
TuxCare security update for org.springframework (12 CVEs)
TuxCare rebuilt 7 org.springframework packages to address 12 CVEs. Fixed in 4.1.9.RELEASE-tuxcare.1.
- Record
CLSA-2026-1782867606- Updated
- 2026-11-02
OSVCLSA-2026-1784509762 No score
TuxCare security update for org.springframework (11 CVEs)
TuxCare rebuilt 6 org.springframework packages to address 11 CVEs. Fixed in 3.0.5.RELEASE-tuxcare.8.
- Record
CLSA-2026-1784509762- Updated
- 2026-11-02
OSVCLSA-2026-1785380133 No score
TuxCare security update for org.springframework (5 CVEs)
TuxCare rebuilt 5 org.springframework packages to address 5 CVEs. Fixed in 4.3.4.RELEASE-tuxcare.2.
- Record
CLSA-2026-1785380133- Updated
- 2026-11-02
OSVCLSA-2026-1785380498 No score
TuxCare security update for org.springframework (6 CVEs)
TuxCare rebuilt 5 org.springframework packages to address 6 CVEs. Fixed in 4.3.9.RELEASE-tuxcare.2.
- Record
CLSA-2026-1785380498- Updated
- 2026-11-02
OSVCLSA-2026-1791107509 No score
TuxCare security update for org.springframework (35 CVEs)
TuxCare rebuilt 10 org.springframework packages to address 35 CVEs. Fixed in 5.0.0.RELEASE-tuxcare.1.
- Record
CLSA-2026-1791107509- Updated
- 2026-11-02
OSVCLSA-2026-1791463819 No score
TuxCare security update for org.springframework (35 CVEs)
TuxCare rebuilt 10 org.springframework packages to address 35 CVEs. Fixed in 4.3.5.RELEASE-tuxcare.1.
- Record
CLSA-2026-1791463819- Updated
- 2026-11-02
Affected products
- spring by pivotal framework
- vmware spring framework
- oracle application testing suite
- oracle big data discovery
- oracle communications converged application server
- oracle communications diameter signaling router
- oracle communications performance intelligence center
- oracle communications policy management
- oracle communications services gatekeeper
- oracle enterprise manager ops center
- oracle goldengate for big data
- oracle health sciences information manager
Show 17 moreShow less
- oracle healthcare master person index
- oracle insurance calculation engine
- oracle insurance rules palette
- oracle primavera gateway
- oracle rapid planning
- oracle retail back office
- oracle retail central office
- oracle retail customer insights
- oracle retail integration bus
- oracle retail open commerce platform
- oracle retail order broker
- oracle retail point-of-sale
- oracle retail predictive application server
- oracle retail returns management
- oracle retail xstore point of service
- oracle service architecture leveraging tuxedo
- oracle tape library acsls
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework:spring-coreMaven |
5.0.0 up to 5.0.5 | 5.0.5 |
org.springframework:spring-coreMaven |
before 4.3.15 | 4.3.15 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 25 CVEs |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1 | 4.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 25 CVEs |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1 | 4.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 25 CVEs |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1 | 4.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 25 CVEs |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1 | 4.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 25 CVEs |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1 | 4.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 25 CVEs |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1 | 4.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
Show 57 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework:spring-coreTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-oxmTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 8 CVEs |
4.1.7.RELEASE up to 4.1.7.RELEASE-tuxcare.2, plus listed versions 4.1.7.RELEASE-tuxcare.1 |
4.1.7.RELEASE-tuxcare.2 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 8 CVEs |
4.1.7.RELEASE up to 4.1.7.RELEASE-tuxcare.2, plus listed versions 4.1.7.RELEASE-tuxcare.1 |
4.1.7.RELEASE-tuxcare.2 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 8 CVEs |
4.1.7.RELEASE up to 4.1.7.RELEASE-tuxcare.2, plus listed versions 4.1.7.RELEASE-tuxcare.1 |
4.1.7.RELEASE-tuxcare.2 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 8 CVEs |
4.2.9.RELEASE up to 4.2.9.RELEASE-tuxcare.1 | 4.2.9.RELEASE-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 8 CVEs |
4.2.9.RELEASE up to 4.2.9.RELEASE-tuxcare.1 | 4.2.9.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 8 CVEs |
4.2.9.RELEASE up to 4.2.9.RELEASE-tuxcare.1 | 4.2.9.RELEASE-tuxcare.1 |
org.springframework:spring-messagingTuxCare:Maven From an advisory covering 8 CVEs |
4.2.9.RELEASE up to 4.2.9.RELEASE-tuxcare.1 | 4.2.9.RELEASE-tuxcare.1 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 12 CVEs |
4.1.9.RELEASE up to 4.1.9.RELEASE-tuxcare.1 | 4.1.9.RELEASE-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 12 CVEs |
4.1.9.RELEASE up to 4.1.9.RELEASE-tuxcare.1 | 4.1.9.RELEASE-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 12 CVEs |
4.1.9.RELEASE up to 4.1.9.RELEASE-tuxcare.1 | 4.1.9.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 12 CVEs |
4.1.9.RELEASE up to 4.1.9.RELEASE-tuxcare.1 | 4.1.9.RELEASE-tuxcare.1 |
org.springframework:spring-messagingTuxCare:Maven From an advisory covering 12 CVEs |
4.1.9.RELEASE up to 4.1.9.RELEASE-tuxcare.1 | 4.1.9.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 12 CVEs |
4.1.9.RELEASE up to 4.1.9.RELEASE-tuxcare.1 | 4.1.9.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 12 CVEs |
4.1.9.RELEASE up to 4.1.9.RELEASE-tuxcare.1 | 4.1.9.RELEASE-tuxcare.1 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 11 CVEs |
3.0.5.RELEASE up to 3.0.5.RELEASE-tuxcare.8, plus listed versions 3.0.5.RELEASE-tuxcare.13.0.5.RELEASE-tuxcare.23.0.5.RELEASE-tuxcare.33.0.5.RELEASE-tuxcare.43.0.5.RELEASE-tuxcare.53.0.5.RELEASE-tuxcare.63.0.5.RELEASE-tuxcare.7 |
3.0.5.RELEASE-tuxcare.8 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 11 CVEs |
3.0.5.RELEASE up to 3.0.5.RELEASE-tuxcare.8, plus listed versions 3.0.5.RELEASE-tuxcare.13.0.5.RELEASE-tuxcare.23.0.5.RELEASE-tuxcare.33.0.5.RELEASE-tuxcare.43.0.5.RELEASE-tuxcare.53.0.5.RELEASE-tuxcare.63.0.5.RELEASE-tuxcare.7 |
3.0.5.RELEASE-tuxcare.8 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 11 CVEs |
3.0.5.RELEASE up to 3.0.5.RELEASE-tuxcare.8, plus listed versions 3.0.5.RELEASE-tuxcare.13.0.5.RELEASE-tuxcare.23.0.5.RELEASE-tuxcare.33.0.5.RELEASE-tuxcare.43.0.5.RELEASE-tuxcare.53.0.5.RELEASE-tuxcare.63.0.5.RELEASE-tuxcare.7 |
3.0.5.RELEASE-tuxcare.8 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 11 CVEs |
3.0.5.RELEASE up to 3.0.5.RELEASE-tuxcare.8, plus listed versions 3.0.5.RELEASE-tuxcare.13.0.5.RELEASE-tuxcare.23.0.5.RELEASE-tuxcare.33.0.5.RELEASE-tuxcare.43.0.5.RELEASE-tuxcare.53.0.5.RELEASE-tuxcare.63.0.5.RELEASE-tuxcare.7 |
3.0.5.RELEASE-tuxcare.8 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 11 CVEs |
3.0.5.RELEASE up to 3.0.5.RELEASE-tuxcare.8, plus listed versions 3.0.5.RELEASE-tuxcare.13.0.5.RELEASE-tuxcare.23.0.5.RELEASE-tuxcare.33.0.5.RELEASE-tuxcare.43.0.5.RELEASE-tuxcare.53.0.5.RELEASE-tuxcare.63.0.5.RELEASE-tuxcare.7 |
3.0.5.RELEASE-tuxcare.8 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 11 CVEs |
3.0.5.RELEASE up to 3.0.5.RELEASE-tuxcare.8, plus listed versions 3.0.5.RELEASE-tuxcare.13.0.5.RELEASE-tuxcare.23.0.5.RELEASE-tuxcare.33.0.5.RELEASE-tuxcare.43.0.5.RELEASE-tuxcare.53.0.5.RELEASE-tuxcare.63.0.5.RELEASE-tuxcare.7 |
3.0.5.RELEASE-tuxcare.8 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 5 CVEs |
4.3.4.RELEASE up to 4.3.4.RELEASE-tuxcare.2, plus listed versions 4.3.4.RELEASE-tuxcare.1 |
4.3.4.RELEASE-tuxcare.2 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 5 CVEs |
4.3.4.RELEASE up to 4.3.4.RELEASE-tuxcare.2, plus listed versions 4.3.4.RELEASE-tuxcare.1 |
4.3.4.RELEASE-tuxcare.2 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 5 CVEs |
4.3.4.RELEASE up to 4.3.4.RELEASE-tuxcare.2, plus listed versions 4.3.4.RELEASE-tuxcare.1 |
4.3.4.RELEASE-tuxcare.2 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 5 CVEs |
4.3.4.RELEASE up to 4.3.4.RELEASE-tuxcare.2, plus listed versions 4.3.4.RELEASE-tuxcare.1 |
4.3.4.RELEASE-tuxcare.2 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 5 CVEs |
4.3.4.RELEASE up to 4.3.4.RELEASE-tuxcare.2, plus listed versions 4.3.4.RELEASE-tuxcare.1 |
4.3.4.RELEASE-tuxcare.2 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 6 CVEs |
4.3.9.RELEASE up to 4.3.9.RELEASE-tuxcare.2, plus listed versions 4.3.9.RELEASE-tuxcare.1 |
4.3.9.RELEASE-tuxcare.2 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 6 CVEs |
4.3.9.RELEASE up to 4.3.9.RELEASE-tuxcare.2, plus listed versions 4.3.9.RELEASE-tuxcare.1 |
4.3.9.RELEASE-tuxcare.2 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 6 CVEs |
4.3.9.RELEASE up to 4.3.9.RELEASE-tuxcare.2, plus listed versions 4.3.9.RELEASE-tuxcare.1 |
4.3.9.RELEASE-tuxcare.2 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 6 CVEs |
4.3.9.RELEASE up to 4.3.9.RELEASE-tuxcare.2, plus listed versions 4.3.9.RELEASE-tuxcare.1 |
4.3.9.RELEASE-tuxcare.2 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 6 CVEs |
4.3.9.RELEASE up to 4.3.9.RELEASE-tuxcare.2, plus listed versions 4.3.9.RELEASE-tuxcare.1 |
4.3.9.RELEASE-tuxcare.2 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 35 CVEs |
5.0.0.RELEASE up to 5.0.0.RELEASE-tuxcare.1 | 5.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-context-supportTuxCare:Maven From an advisory covering 35 CVEs |
5.0.0.RELEASE up to 5.0.0.RELEASE-tuxcare.1 | 5.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 35 CVEs |
5.0.0.RELEASE up to 5.0.0.RELEASE-tuxcare.1 | 5.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 35 CVEs |
5.0.0.RELEASE up to 5.0.0.RELEASE-tuxcare.1 | 5.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-jmsTuxCare:Maven From an advisory covering 35 CVEs |
5.0.0.RELEASE up to 5.0.0.RELEASE-tuxcare.1 | 5.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-messagingTuxCare:Maven From an advisory covering 35 CVEs |
5.0.0.RELEASE up to 5.0.0.RELEASE-tuxcare.1 | 5.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 35 CVEs |
5.0.0.RELEASE up to 5.0.0.RELEASE-tuxcare.1 | 5.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 35 CVEs |
5.0.0.RELEASE up to 5.0.0.RELEASE-tuxcare.1 | 5.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 35 CVEs |
5.0.0.RELEASE up to 5.0.0.RELEASE-tuxcare.1 | 5.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-websocketTuxCare:Maven From an advisory covering 35 CVEs |
5.0.0.RELEASE up to 5.0.0.RELEASE-tuxcare.1 | 5.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-context-supportTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-jmsTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-messagingTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-websocketTuxCare:Maven From an advisory covering 35 CVEs |
4.3.5.RELEASE up to 4.3.5.RELEASE-tuxcare.1 | 4.3.5.RELEASE-tuxcare.1 |
org.springframework:spring-coreMaven |
5.0.0 up to 5.0.5, plus listed versions 5.0.0.RELEASE5.0.1.RELEASE5.0.2.RELEASE5.0.3.RELEASE5.0.4.RELEASE |
5.0.5 |
org.springframework:spring-coreMaven |
before 4.3.15, plus listed versions 1.01.0-rc11.0.11.11.1-rc1 Show 45 moreShow less1.1-rc21.1.11.1.21.1.31.1.41.1.51.21.2-rc11.2-rc21.2.11.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.92.02.0-m12.0-m22.0-m32.0-m42.0-m52.0-rc12.0-rc22.0.12.0.22.0.32.0.42.0.52.0.62.0.72.0.82.52.5.12.5.22.5.32.5.42.5.52.5.62.5.6.SEC012.5.6.SEC022.5.6.SEC033.0.0.RELEASE |
4.3.15 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | Spring MVC Framework - Local File Inclusion |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, Nuclei, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-1271 is a medium vulnerability (CVSS 5.9) in Spring By Pivotal Framework, published April 6, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 30.3%, the 98th percentile. Fixed in org.springframework:spring-core 5.0.5.
References
securityfocus.com/bid/103699
access.redhat.com/errata/RHSA-2018:2669
oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
Show 15 moreShow less
pivotal.io/security/cve-2018-1271
nvd.nist.gov/vuln/detail/CVE-2018-1271
github.com/advisories/GHSA-g8hw-794c-4j9g
Left out here: 76 versions. The JSON record has them.