CVE-2018-1272: oracle application_testing_suite
Vulnerability summary
CVE-2018-1272 is a high (CVSS 7.5) vulnerability in oracle application_testing_suite. EPSS estimates a 3.06% chance of exploitation in the next 30 days, higher than 87.4% of scored vulnerabilities.
Timeline
- 06-04-2018PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.
CVSS metrics
4 scores · 3 sources · 3 versions- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
3.06%
Chance of exploitation in the next 30 days
Percentile
87%
Versus all other CVEs
30-day change
0.00 pp
From 3.06% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Oracle24 products
- application_testing_suite12.5.0.3 | 13.1.0.1 | 13.2.0.1 | 13.3.0.1
- big_data_discovery1.6.0
- communications_converged_application_server< 7.0.0.1
- communications_diameter_signaling_router< 8.3
- communications_performance_intelligence_center< 10.2.1
Debian1 product
- libspring-java< 4.3.19-1
Org.springframework1 product
- spring-core< 4.3.15 | ≥ 5.0.0, < 5.0.5
Spring by pivotal1 product
- spring frameworkVersions prior to 5.0.5 and 4.3.15
Vmware1 product
- spring_framework≥ 4.3.0, < 4.3.15 | ≥ 5.0, < 5.0.5
5 vendors · 28 products
References
15 links- www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlX Refsource CONFIRMPatchThird Party AdvisoryWEB
- www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlX Refsource CONFIRMPatchThird Party AdvisoryWEB
- www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlX Refsource CONFIRMPatchThird Party AdvisoryWEB
- www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlX Refsource MISCPatchThird Party AdvisoryWEB
