CVE-2018-1271

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.

Link	Resource
https://pivotal.io/security/cve-2018-1271	Vendor Advisory
http://www.securityfocus.com/bid/103699	Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2018:1320	Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html	Patch Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2669	Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html	Patch Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2939	Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html	Patch Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html	Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html	Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html	Third Party Advisory

Configuration 1

cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_gateway:16.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_gateway:15.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_open_commerce_platform:6.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_testing_suite:13.1.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_testing_suite:13.2.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_performance_intelligence_center:*:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_rules_palette:10.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_rules_palette:10.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_services_gatekeeper:*:*:*:*:*:*:*:* cpe:2.3:a:oracle:health_sciences_information_manager:3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_master_person_index:3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:healthcare_master_person_index:4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_calculation_engine:10.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_customer_insights:15.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_customer_insights:16.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:tape_library_acsls:8.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_converged_application_server:*:*:*:*:*:*:*:* cpe:2.3:a:oracle:service_architecture_leveraging_tuxedo:12.1.3.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:service_architecture_leveraging_tuxedo:12.2.2.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_predictive_application_server:14.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_predictive_application_server:14.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_predictive_application_server:15.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_predictive_application_server:16.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_order_broker:5.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_order_broker:5.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_order_broker:15.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_order_broker:16.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_open_commerce_platform:5.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_open_commerce_platform:6.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_calculation_engine:10.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_calculation_engine:10.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_rules_palette:10.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_rules_palette:11.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_rules_palette:11.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_gateway:17.12:*:*:*:*:*:*:* cpe:2.3:a:oracle:big_data_discovery:1.6.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:goldengate_for_big_data:12.2.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:goldengate_for_big_data:12.3.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:goldengate_for_big_data:12.3.2.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_integration_bus:14.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_integration_bus:14.0.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_integration_bus:14.0.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_integration_bus:14.0.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_integration_bus:16.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_integration_bus:16.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_integration_bus:16.0.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_integration_bus:15.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_integration_bus:15.0.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_integration_bus:15.0.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_integration_bus:14.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_integration_bus:14.1.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_integration_bus:14.1.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_returns_management:14.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_point-of-sale:14.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_point-of-sale:14.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_central_office:14.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_central_office:14.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:rapid_planning:12.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:rapid_planning:12.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:insurance_calculation_engine:*:*:*:*:*:*:*:*

---

Published : 2018-04-06 01:29

Updated : 2022-06-23 04:33

---

NVD link : CVE-2018-1271

Mitre link : CVE-2018-1271

No products.

CWE-22