Improper input validation in Dell EMC Spring By Pivotal
CVE-2018-1199
Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. In this particular attack, different character encodings used in path parameters allows secured Spring MVC static resource URLs to be bypassed.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.029 (86.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Dell Emc Spring By Pivotal — versions spring Security 4.1.0 - 4.1.4, 4.2.0 - 4.2.3, 5.0.0, Older unmaintained versions of Spring Security & Spring Framework were not analyzed and may be impacted, Spring Framework 5.0.0 - 5.0.2, 4.3.0 - 4.3.13
- Oracle Rapid_planning — versions 12.1, 12.2
- Oracle Retail_xstore_point_of_service — versions 7.1
- Vmware Spring_framework
- Vmware Spring_security
- Redhat Fuse — versions 1.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security_alert@emc.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
- security_alert@emc.com (mailing-list, x_refsource_MLIST)
- security_alert@emc.com (mailing-list, x_refsource_MLIST)
- security_alert@emc.com (mailing-list, x_refsource_MLIST)
- security_alert@emc.com (Third Party Advisory, x_refsource_MISC)
- security_alert@emc.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2018-1199?
- CVE-2018-1199 is a medium-severity vulnerability in Dell EMC Spring By Pivotal, classified under Improper Input Validation. CVSS score: 5.3/10. Published 2018-03-16.
- How severe is CVE-2018-1199?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2018-1199 known to be exploited?
- 5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.