CVE-2018-1258
Spring Framework when used in combination with any versions of Spring Security contains an authorization bypass
Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.
- Record
CVE-2018-1258- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-863
- Updated
- 2026-11-02
CVE List No score
Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.
- Record
CVE-2018-1258- Updated
- 2026-11-02
EUVDEUVD-2018-0586 No score
Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.
- Record
EUVD-2018-0586- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cxrj-66c5-9fmh
Spring Framework when used in combination with any versions of Spring Security contains an authorization bypass
Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.
- Record
GHSA-cxrj-66c5-9fmh- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-863
- Updated
- 2026-11-02
OSV
Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.
- Record
CVE-2018-1258- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-cxrj-66c5-9fmh
Spring Framework when used in combination with any versions of Spring Security contains an authorization bypass
Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.
- Record
GHSA-cxrj-66c5-9fmh- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVCLSA-2026-1785814744 No score
TuxCare security update for org.springframework (9 CVEs)
TuxCare rebuilt 7 org.springframework packages to address 9 CVEs. Fixed in 5.0.5.RELEASE-tuxcare.2.
- Record
CLSA-2026-1785814744- Updated
- 2026-11-02
Affected products
- pivotal spring framework
- pivotal software spring security
- vmware spring framework
- netapp oncommand insight
- netapp oncommand unified manager
- netapp oncommand workflow automation
- netapp snapcenter
- netapp storage automation store
- oracle agile product lifecycle management
- oracle application testing suite
- oracle big data discovery
- oracle communications converged application server
Show 31 moreShow less
- oracle communications diameter signaling router
- oracle communications network integrity
- oracle communications performance intelligence center
- oracle communications services gatekeeper
- oracle endeca information discovery integrator
- oracle enterprise manager for mysql database
- oracle enterprise manager ops center
- oracle enterprise repository
- oracle goldengate for big data
- oracle health sciences information manager
- oracle healthcare master person index
- oracle hospitality guest access
- oracle insurance calculation engine
- oracle insurance policy administration
- oracle insurance rules palette
- oracle micros lucas
- oracle mysql enterprise monitor
- oracle peoplesoft enterprise fin install
- oracle retail assortment planning
- oracle retail back office
- oracle retail central office
- oracle retail customer insights
- oracle retail financial integration
- oracle retail integration bus
- oracle retail point-of-service
- oracle retail returns management
- oracle retail xstore point of service
- oracle service architecture leveraging tuxedo
- oracle tape library acsls
- oracle weblogic server
- redhat fuse
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework:spring-coreMaven |
5.0.5.RELEASE to 5.0.5.RELEASE | 5.0.6.RELEASE |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 9 CVEs |
5.0.5.RELEASE up to 5.0.5.RELEASE-tuxcare.2, plus listed versions 5.0.5.RELEASE-tuxcare.1 |
5.0.5.RELEASE-tuxcare.2 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 9 CVEs |
5.0.5.RELEASE up to 5.0.5.RELEASE-tuxcare.2, plus listed versions 5.0.5.RELEASE-tuxcare.1 |
5.0.5.RELEASE-tuxcare.2 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 9 CVEs |
5.0.5.RELEASE up to 5.0.5.RELEASE-tuxcare.2, plus listed versions 5.0.5.RELEASE-tuxcare.1 |
5.0.5.RELEASE-tuxcare.2 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 9 CVEs |
5.0.5.RELEASE up to 5.0.5.RELEASE-tuxcare.2, plus listed versions 5.0.5.RELEASE-tuxcare.1 |
5.0.5.RELEASE-tuxcare.2 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 9 CVEs |
5.0.5.RELEASE up to 5.0.5.RELEASE-tuxcare.2, plus listed versions 5.0.5.RELEASE-tuxcare.1 |
5.0.5.RELEASE-tuxcare.2 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 9 CVEs |
5.0.5.RELEASE up to 5.0.5.RELEASE-tuxcare.2, plus listed versions 5.0.5.RELEASE-tuxcare.1 |
5.0.5.RELEASE-tuxcare.2 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 9 CVEs |
5.0.5.RELEASE up to 5.0.5.RELEASE-tuxcare.2, plus listed versions 5.0.5.RELEASE-tuxcare.1 |
5.0.5.RELEASE-tuxcare.2 |
org.springframework:spring-coreMaven |
5.0.5.RELEASE up to 5.0.6.RELEASE | 5.0.6.RELEASE |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-1258 is a high vulnerability (CVSS 8.8) in Pivotal Spring Framework, published May 11, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.46%, the 84th percentile. Fixed in org.springframework:spring-core 5.0.6.RELEASE.
References
securityfocus.com/bid/104222
securitytracker.com/id/1041888
access.redhat.com/errata/RHSA-2019:2413
oracle.com/security-alerts/cpuapr2020.html
Show 17 moreShow less
security.netapp.com/advisory/ntap-20181018-0002
pivotal.io/security/cve-2018-1258
nvd.nist.gov/vuln/detail/CVE-2018-1258
github.com/advisories/GHSA-cxrj-66c5-9fmh
web.archive.org/web/20200807033751/http://www.securitytracker.com/id/1041896