Vulnerability in Oracle Agile Plm
CVE-2018-15756
Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.092 (95.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 95th percentile — 95.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.092 · newest: 0.092 · change: 0.000
Affected products
- Oracle Agile Plm — versions 9.3.3, 9.3.4, 9.3.5
- Oracle Agile Product Lifecycle Management — versions 9.3.3, 9.3.4, 9.3.5
- Oracle Communications Brm - Elastic Charging Engine — versions 11.3, 12.0
- Oracle Communications Converged Application Server - Service Controller — versions 6.0, 6.1
- Oracle Communications Diameter Signaling Router — versions 8.0.0, 8.1, 8.2
- Oracle Communications Element Manager — versions 8.1.1, 8.2.0, 8.2.1
- Oracle Communications Online Mediation Controller — versions 6.1
- Oracle Communications Session Report Manager — versions 8.0.0, 8.1.0, 8.1.1
- Oracle Communications Session Route Manager — versions 8.0.0, 8.1.0, 8.1.1
- Oracle Communications Unified Inventory Management — versions 7.3, 7.4.0
Public proof-of-concept exploits
References
- www.securityfocus.com/bid/105703 (URL Repurposed, VDB Entry, Third Party Advisory, vdb-entry)
- lists.apache.org/thread.html/a3071e11c6fbd593022074ec1b4693f6d948c2b02cfa4a5d85… (mailing-list)
- lists.apache.org/thread.html/339fd112517e4873695b5115b96acdddbfc8f83b10598528d3… (mailing-list)
- lists.apache.org/thread.html/d6a84f52db89804b0ad965f3ea2b24bb880edee29107a1c506… (mailing-list)
- lists.apache.org/thread.html/bb354962cb51fff65740d5fb1bc2aac56af577c06244b57c36… (mailing-list)
- lists.apache.org/thread.html/7b156ee50ba3ecce87b33c06bf7a749d84ffee55e69bfb5eca… (mailing-list)
- lists.apache.org/thread.html/77886fec378ee6064debb1efb6b464a4a0173b2ff0d151ed86… (mailing-list)
- lists.apache.org/thread.html/8a1fe70534fc52ff5c9db5ac29c55657f802cbefd7e9d9850c… (mailing-list)
- lists.apache.org/thread.html/efaa52b0aa67aae7cbd9e6ef96945387e422d7ce0e65434570… (mailing-list)
- lists.apache.org/thread.html/f8905507a2c94af6b08b72d7be0c4b8c6660e585f00abfafec… (mailing-list)
Frequently asked questions
- What is CVE-2018-15756?
- CVE-2018-15756 is a high-severity vulnerability in Oracle Agile Plm. CVSS score: 7.5/10. Published 2018-10-18.
- How severe is CVE-2018-15756?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2018-15756 known to be exploited?
- 6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.