Skip to main content

Improperly Implemented Security Check for Standard in org.springframework:spring-messaging

CVE-2018-1275

  • org.springframework:spring-messaging
High
9.8/10

Summary

Spring Framework, versions 4.0.x prior to 4.3.16 and 5.0.x prior to 5.0.5, and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory "STOMP" broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack. This CVE addresses the partial fix for CVE-2018-1270 in the 4.3.x branch of the Spring Framework.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • HIGH

CWE-358 - Improperly Implemented Security Check for Standard

The software does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.

References

Advisory Timeline

  • Published