CVE-2018-1270
- State
- Published
- Severity
- Not scored
- Published
- Apr 6, 2018
- Updated
- Oct 8, 2026
- Reserved
- Dec 6, 2017
Description
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.
Scores
The record has no CVSS score.
Weaknesses
- CWE-94 Code Injection
Affected Products
| Product | Versions |
|---|---|
Spring FrameworkSpring by Pivotal |
|
References
- RHSA-2018:2939vendor-advisory
- 44796exploit
- 103696vdb-entry
- [activemq-issues] 20190703 [jira] [Created] (AMQ-7236) SEV-1 Security vulnerability in spring-expression-4.3.11.RELEASE.jar (spring framework)mailing-list
- [activemq-issues] 20190703 [jira] [Updated] (AMQ-7236) SEV-1 Security vulnerability in spring-expression-4.3.11.RELEASE.jar (spring framework) and xstream-1.4.10.jarmailing-list
- [activemq-issues] 20190718 [jira] [Updated] (AMQ-7236) SEV-1 Security vulnerability in spring-expression-4.3.11.RELEASE.jar (spring framework) and xstream-1.4.10.jarmailing-list
- [activemq-issues] 20190826 [jira] [Created] (AMQ-7288) Security Vulnerabilities in ActiveMQ dependent libraries.mailing-list
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://pivotal.io/security/cve-2018-1270
- [geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12mailing-list
- [debian-lts-announce] 20210423 [SECURITY] [DLA 2635-1] libspring-java security updatemailing-list
- https://www.oracle.com/security-alerts/cpuoct2021.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.