← לוח פגיעויות

CVE-2018-1257

בינונית 6.5

תיאור (מקור, אנגלית)

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.

מדדים

CVSS 3.1
6.5 (MEDIUM) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS — סבירות ניצול
3% (אחוזון 100) נכון ל-14/10/2026

מוצרים מושפעים

vmware: spring framework; redhat: openshift; oracle: agile product lifecycle management; oracle: application testing suite; oracle: big data discovery; oracle: communications converged application server; oracle: communications diameter signaling router; oracle: communications performance intelligence center; oracle: communications services gatekeeper; oracle: communications unified inventory management; oracle: endeca information discovery integrator; oracle: enterprise manager base platform; oracle: enterprise manager for mysql database; oracle: enterprise manager ops center; oracle: flexcube private banking

קישורים