Vulnerability in Pivotal Spring Framework
CVE-2018-15756
Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequ…
EPSS: 0.201 (95.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Pivotal Spring Framework — versions 4.3, 5.0.0, 5.1
Public proof-of-concept exploits
References
- 105703 (vdb-entry, x_refsource_BID)
- [activemq-issues] 20190529 [jira] [Created] (ARTEMIS-2363) spring-core-5.0.1.RELEASE.jar vulnerable to CVE-2018-15756 (mailing-list, x_refsource_MLIST)
- [activemq-issues] 20190529 [jira] [Commented] (ARTEMIS-2363) spring-core-5.0.1.RELEASE.jar vulnerable to CVE-2018-15756 (mailing-list, x_refsource_MLIST)
- [activemq-issues] 20190529 [jira] [Updated] (ARTEMIS-2363) spring-core-5.0.1.RELEASE.jar vulnerable to CVE-2018-15756 (mailing-list, x_refsource_MLIST)
- [activemq-issues] 20190626 [jira] [Assigned] (ARTEMIS-2363) spring-core-5.0.1.RELEASE.jar vulnerable to CVE-2018-15756 (mailing-list, x_refsource_MLIST)
- [activemq-issues] 20190626 [jira] [Work logged] (ARTEMIS-2363) spring-core-5.0.1.RELEASE.jar vulnerable to CVE-2018-15756 (mailing-list, x_refsource_MLIST)
- [activemq-issues] 20190716 [jira] [Commented] (ARTEMIS-2363) spring-core-5.0.1.RELEASE.jar vulnerable to CVE-2018-15756 (mailing-list, x_refsource_MLIST)
- [activemq-issues] 20190826 [jira] [Reopened] (ARTEMIS-2363) spring-core-5.0.1.RELEASE.jar vulnerable to CVE-2018-15756 (mailing-list, x_refsource_MLIST)
- [activemq-issues] 20190826 [jira] [Closed] (ARTEMIS-2363) spring-core-5.0.1.RELEASE.jar vulnerable to CVE-2018-15756 (mailing-list, x_refsource_MLIST)
- [activemq-issues] 20190826 [jira] [Updated] (ARTEMIS-2363) spring-core-5.0.1.RELEASE.jar vulnerable to CVE-2018-15756 (mailing-list, x_refsource_MLIST)
Frequently asked questions
- What is CVE-2018-15756?
- CVE-2018-15756 is a high-severity vulnerability in Pivotal Spring Framework. CVSS score: 7.5/10. Published 2018-10-18.
- How severe is CVE-2018-15756?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2018-15756 known to be exploited?
- 6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.