CVE-2018-1271

Scores

EPSS

0.906high90.6%
0%20%40%60%80%100%

Percentile: 90.6%

CVSS

6.5medium3.x
0246810

CVSS Score: 6.5/10

All CVSS Scores

CVSS 3.x
6.5

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

CVSS 2.0
4.3

Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

Description

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.

Scaner-VS 7 — a modern vulnerability management solution

Uses this database for vulnerability detection. High-speed search, cross-platform, advanced configuration audit, and flexible filtering. Suitable for organizations of any size.
Learn more about Scaner-VS 7

Sources

debiannvdubuntu

CWEs

CWE-22

Vulnerable Software (35)

Type: Configuration

Product: libspring-java

Operating System: ubuntu artful 17.10

Trait:
{  "unfixed": true}

Source: ubuntu

Type: Configuration

Product: libspring-java

Operating System: ubuntu bionic 18.04

Trait:
{  "unaffected": true}

Source: ubuntu

Type: Configuration

Product: libspring-java

Operating System: ubuntu cosmic 18.10

Trait:
{  "unaffected": true}

Source: ubuntu

Type: Configuration

Product: libspring-java

Operating System: ubuntu disco 19.04

Trait:
{  "unaffected": true}

Source: ubuntu

Type: Configuration

Product: libspring-java

Operating System: ubuntu trusty 14.04

Trait:
{  "unfixed": true}

Source: ubuntu

Type: Configuration

Product: libspring-java

Operating System: ubuntu xenial 16.04

Trait:
{  "unaffected": true}

Source: ubuntu

Type: Configuration

Product: libspring-java

Operating System: debian

Trait:
{  "unaffected": true}

Source: debian

Type: Configuration

Vendor: *

Product: application_testing_suite

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:a:oracle:application_te...

Source: nvd

Type: Configuration

Vendor: *

Product: big_data_discovery

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:a:oracle:application_te...

Source: nvd

Type: Configuration

Vendor: *

Product: communications_converged_application_server

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:a:oracle:application_te...

Source: nvd

Type: Configuration

Vendor: *

Product: communications_diameter_signaling_router

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:a:oracle:application_te...

Source: nvd

Type: Configuration

Vendor: *

Product: communications_performance_intelligence_center

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:a:oracle:application_te...

Source: nvd

Type: Configuration

Vendor: *

Product: communications_policy_management

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:a:oracle:application_te...

Source: nvd

Type: Configuration

Vendor: *

Product: communications_services_gatekeeper

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:a:oracle:application_te...

Source: nvd

Type: Configuration

Vendor: *

Product: enterprise_manager_ops_center

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:a:oracle:application_te...

Source: nvd

Type: Configuration

Vendor: *

Product: goldengate_for_big_data

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:a:oracle:application_te...

Source: nvd

Type: Configuration

Vendor: *

Product: health_sciences_information_manager

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:a:oracle:application_te...

Source: nvd

Type: Configuration

Vendor: *

Product: healthcare_master_person_index

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:a:oracle:application_te...

Source: nvd

Type: Configuration

Vendor: *

Product: insurance_calculation_engine

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:a:oracle:application_te...

Source: nvd

Type: Configuration

Vendor: *

Product: insurance_rules_palette

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:a:oracle:application_te...

Source: nvd