CVE-2018-1257: oracle agile_product_lifecycle_management
Vulnerability summary
CVE-2018-1257 is a medium (CVSS 6.5) vulnerability in oracle agile_product_lifecycle_management. EPSS estimates a 3.04% chance of exploitation in the next 30 days, higher than 87.3% of scored vulnerabilities.
Timeline
- 11-05-2018PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.
CVSS metrics
5 scores · 4 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
3.04%
Chance of exploitation in the next 30 days
Percentile
87%
Versus all other CVEs
30-day change
-0.09 pp
From 3.12% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Oracle28 products
- agile_product_lifecycle_management9.3.3 | 9.3.4 | 9.3.5 | 9.3.6
- application_testing_suite12.5.0.3 | 13.1.0.1 | 13.2.0.1 | 13.3.0.1
- big_data_discovery1.6.0
- communications_converged_application_server< 7.0.0.1
- communications_diameter_signaling_router< 8.3
Debian1 product
- libspring-java< 4.3.19-1
Org.springframework1 product
- spring-core≥ 5.0.0, < 5.0.6 | < 4.3.17
Pivotal1 product
- spring framework5.0.x prior to 5.0.6; 4.3.x prior to 4.3.17
Redhat1 product
Ubuntu1 product
- libspring-javaAll versions (No fix recorded)
Vmware1 product
- spring_framework< 4.3.17 | ≥ 5.0.0, < 5.0.6
7 vendors · 34 products
References
19 links- www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlX Refsource CONFIRMPatchThird Party AdvisoryWEB
- www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlX Refsource CONFIRMPatchThird Party AdvisoryWEB
- www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlX Refsource MISCPatchThird Party AdvisoryWEB
- www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlX Refsource MISCPatchThird Party AdvisoryWEB
