CVE Feed

    Dashboard / CVE / CVE-2018-1271

    CVE-2018-1271

    Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.

    Published:Apr 5, 2018
    Last Modified:Nov 21, 2024
    EPS:Apr 6, 2018
    EPSS Score:0.90926
    CVSS Score:5.9

    Affected Products

    Vendor
    Oracle
    Product
    Application Testing Suite
    Vendor
    Oracle
    Product
    Big Data Discovery
    Vendor
    Oracle
    Product
    Communications Converged Application Server
    Vendor
    Oracle
    Product
    Communications Diameter Signaling Router
    Vendor
    Oracle
    Product
    Communications Performance Intelligence Center
    Vendor
    Oracle
    Product
    Communications Policy Management
    Vendor
    Oracle
    Product
    Communications Services Gatekeeper
    Vendor
    Oracle
    Product
    Enterprise Manager Ops Center
    Vendor
    Oracle
    Product
    Goldengate For Big Data
    Vendor
    Oracle
    Product
    Health Sciences Information Manager
    Vendor
    Oracle
    Product
    Healthcare Master Person Index
    Vendor
    Oracle
    Product
    Insurance Calculation Engine
    Vendor
    Oracle
    Product
    Insurance Rules Palette
    Vendor
    Oracle
    Product
    Primavera Gateway
    Vendor
    Oracle
    Product
    Rapid Planning
    Vendor
    Oracle
    Product
    Retail Back Office
    Vendor
    Oracle
    Product
    Retail Central Office
    Vendor
    Oracle
    Product
    Retail Customer Insights
    Vendor
    Oracle
    Product
    Retail Integration Bus
    Vendor
    Oracle
    Product
    Retail Open Commerce Platform
    Vendor
    Oracle
    Product
    Retail Order Broker
    Vendor
    Oracle
    Product
    Retail Point-of-sale
    Vendor
    Oracle
    Product
    Retail Predictive Application Server
    Vendor
    Oracle
    Product
    Retail Returns Management
    Vendor
    Oracle
    Product
    Retail Xstore Point Of Service
    Vendor
    Oracle
    Product
    Service Architecture Leveraging Tuxedo
    Vendor
    Oracle
    Product
    Tape Library Acsls
    Vendor
    Redhat
    Product
    Jboss Fuse
    Vendor
    Redhat
    Product
    Openshift Application Runtimes
    Vendor
    Vmware
    Product
    Spring Framework

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-70868 (CVSS 8.1) — Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Diffi…
    CVE-2026-70867 (CVSS 7.1) — Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easil…
    CVE-2026-70866 (CVSS 7.8) — Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easil…
    CVE-2026-70865 (CVSS 7.5) — Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Diffi…
    CVE-2026-70864 (CVSS 7.6) — Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easil…
    CVE-2026-70863 (CVSS 8.8) — Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easil…
    CVE-2026-70862 (CVSS 9.1) — Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easil…
    CVE-2026-46924 (CVSS 9.8) — Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easil…
    CVE-2026-46876 (CVSS 9.8) — Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easil…
    CVE-2026-35290 (CVSS 9.8) — Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easil…

    References

    http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
    http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
    http://www.securityfocus.com/bid/103699
    https://access.redhat.com/errata/RHSA-2018:1320
    https://access.redhat.com/errata/RHSA-2018:2669
    https://access.redhat.com/errata/RHSA-2018:2939
    https://pivotal.io/security/cve-2018-1271
    https://www.oracle.com/security-alerts/cpujul2020.html
    https://www.oracle.com/security-alerts/cpuoct2021.html
    https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
    https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
    http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
    http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
    http://www.securityfocus.com/bid/103699
    https://access.redhat.com/errata/RHSA-2018:1320
    https://access.redhat.com/errata/RHSA-2018:2669
    https://access.redhat.com/errata/RHSA-2018:2939
    https://pivotal.io/security/cve-2018-1271
    https://www.oracle.com/security-alerts/cpujul2020.html
    https://www.oracle.com/security-alerts/cpuoct2021.html
    https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
    https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High