CVE-2018-1257
—CVSS 3.1
6.5 medium
EPSS
3%p88
Published
()
Modified
Description
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.
- Vendors
- vmwareredhatoracle
- Products
- spring framework, openshift, agile product lifecycle management, application testing suite, big data discovery, communications converged application server, communications diameter signaling router, communications performance intelligence center, communications services gatekeeper, communications unified inventory management, endeca information discovery integrator, enterprise manager base platform
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
In the news0 stories
No ingested article mentions this CVE yet.