CVE Feed

    Dashboard / CVE / CVE-2018-1258

    CVE-2018-1258

    Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.

    Published:May 9, 2018
    Last Modified:Aug 25, 2026
    EPS:May 11, 2018
    EPSS Score:0.02457
    CVSS Score:8.8

    Affected Products

    Vendor
    Netapp
    Product
    Oncommand Insight
    Vendor
    Netapp
    Product
    Oncommand Unified Manager
    Vendor
    Netapp
    Product
    Oncommand Workflow Automation
    Vendor
    Netapp
    Product
    Snapcenter
    Vendor
    Netapp
    Product
    Storage Automation Store
    Vendor
    Oracle
    Product
    Agile Product Lifecycle Management
    Vendor
    Oracle
    Product
    Application Testing Suite
    Vendor
    Oracle
    Product
    Big Data Discovery
    Vendor
    Oracle
    Product
    Communications Converged Application Server
    Vendor
    Oracle
    Product
    Communications Diameter Signaling Router
    Vendor
    Oracle
    Product
    Communications Network Integrity
    Vendor
    Oracle
    Product
    Communications Performance Intelligence Center
    Vendor
    Oracle
    Product
    Communications Services Gatekeeper
    Vendor
    Oracle
    Product
    Endeca Information Discovery Integrator
    Vendor
    Oracle
    Product
    Enterprise Manager For Mysql Database
    Vendor
    Oracle
    Product
    Enterprise Manager Ops Center
    Vendor
    Oracle
    Product
    Enterprise Repository
    Vendor
    Oracle
    Product
    Goldengate For Big Data
    Vendor
    Oracle
    Product
    Health Sciences Information Manager
    Vendor
    Oracle
    Product
    Healthcare Master Person Index
    Vendor
    Oracle
    Product
    Hospitality Guest Access
    Vendor
    Oracle
    Product
    Insurance Calculation Engine
    Vendor
    Oracle
    Product
    Insurance Policy Administration
    Vendor
    Oracle
    Product
    Insurance Rules Palette
    Vendor
    Oracle
    Product
    Micros Lucas
    Vendor
    Oracle
    Product
    Mysql Enterprise Monitor
    Vendor
    Oracle
    Product
    Peoplesoft Enterprise Fin Install
    Vendor
    Oracle
    Product
    Retail Assortment Planning
    Vendor
    Oracle
    Product
    Retail Back Office
    Vendor
    Oracle
    Product
    Retail Central Office
    Vendor
    Oracle
    Product
    Retail Customer Insights
    Vendor
    Oracle
    Product
    Retail Financial Integration
    Vendor
    Oracle
    Product
    Retail Integration Bus
    Vendor
    Oracle
    Product
    Retail Point-of-service
    Vendor
    Oracle
    Product
    Retail Returns Management
    Vendor
    Oracle
    Product
    Retail Xstore Point Of Service
    Vendor
    Oracle
    Product
    Service Architecture Leveraging Tuxedo
    Vendor
    Oracle
    Product
    Tape Library Acsls
    Vendor
    Oracle
    Product
    Weblogic Server
    Vendor
    Pivotal Software
    Product
    Spring Security
    Vendor
    Redhat
    Product
    Fuse
    Vendor
    Redhat
    Product
    Jboss Fuse
    Vendor
    Vmware
    Product
    Spring Framework

    Exploits

    No exploit reference

    Related CVEs

    CVE-2025-24970 (CVSS 7.5) — Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.…
    CVE-2025-21492 (CVSS 4.9) — Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions …
    CVE-2025-21502 (CVSS 4.8) — Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac…
    CVE-2024-21262 (CVSS 6.5) — Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). Supported versions…
    CVE-2024-38808 (CVSS 4.3) — In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provi…
    CVE-2024-21138 (CVSS 3.7) — Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac…
    CVE-2024-21131 (CVSS 3.7) — Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac…
    CVE-2024-21145 (CVSS 4.8) — Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac…
    CVE-2024-21140 (CVSS 4.8) — Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac…
    CVE-2024-21147 (CVSS 7.4) — Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac…

    References

    http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
    http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
    http://www.securityfocus.com/bid/104222
    http://www.securitytracker.com/id/1041888
    http://www.securitytracker.com/id/1041896
    https://access.redhat.com/errata/RHSA-2019:2413
    https://pivotal.io/security/cve-2018-1258
    https://security.netapp.com/advisory/ntap-20181018-0002/
    https://www.oracle.com/security-alerts/cpuapr2020.html
    https://www.oracle.com/security-alerts/cpujan2020.html
    https://www.oracle.com/security-alerts/cpujan2021.html
    https://www.oracle.com/security-alerts/cpujul2020.html
    https://www.oracle.com/security-alerts/cpuoct2021.html
    https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
    https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
    https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
    http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
    http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
    http://www.securityfocus.com/bid/104222
    http://www.securitytracker.com/id/1041888
    http://www.securitytracker.com/id/1041896
    https://access.redhat.com/errata/RHSA-2019:2413
    https://pivotal.io/security/cve-2018-1258
    https://security.netapp.com/advisory/ntap-20181018-0002/
    https://www.oracle.com/security-alerts/cpuapr2020.html
    https://www.oracle.com/security-alerts/cpujan2020.html
    https://www.oracle.com/security-alerts/cpujan2021.html
    https://www.oracle.com/security-alerts/cpujul2020.html
    https://www.oracle.com/security-alerts/cpuoct2021.html
    https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
    https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
    https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High