CVE-2018-1199

Severity CVSS v4.0:

Pending analysis

Type:

CWE-20 Input Validation

Publication date:

16/03/2018

Last modified:

07/11/2023

Description

Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. In this particular attack, different character encodings used in path parameters allows secured Spring MVC static resource URLs to be bypassed.

Impact

Vector 3.x

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS v3.1 Severity and Metrics:

Base Score: 5.30 MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): Low
Integrity (I): None
Availability (A): None

Base Score 3.x

5.30

Severity 3.x

MEDIUM

Vector 2.0

AV:N/AC:L/Au:N/C:P/I:N/A:N CVSS v2.0 Severity and Metrics:

Base Score: 5.00 MEDIUM
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Attack Vector (AV): Network
Attack Complexity (AC): Low
Authentication (Au): None
Confidentiality (C): Physical
Integrity (I): None
Availability (A): None

Base Score 2.0

5.00

Severity 2.0

MEDIUM

Vulnerable products and versions

CPE	From	Up to
cpe:2.3:a:vmware:spring_framework::::::::	4.3.0 (including)	4.3.14 (excluding)
cpe:2.3:a:vmware:spring_framework::::::::	5.0.0 (including)	5.0.3 (excluding)
cpe:2.3:a:vmware:spring_security::::::::	4.1.0 (including)	4.1.5 (excluding)
cpe:2.3:a:vmware:spring_security::::::::	4.2.0 (including)	4.2.4 (excluding)
cpe:2.3:a:vmware:spring_security::::::::	5.0.0 (including)	5.0.1 (excluding)
cpe:2.3:a:redhat:fuse:1.0:::::::*
cpe:2.3:a:oracle:rapid_planning:12.1:::::::*
cpe:2.3:a:oracle:rapid_planning:12.2:::::::*
cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:::::::*

To consult the complete list of CPE names with products and versions, see this page

CVE-2018-1199

Description

Impact

Vulnerable products and versions

References to Advisories, Solutions, and Tools