SECUFOCUSNOW
Home›CVE index›CVE-2018-15756
ReviewHigh

CVE-2018-15756

Pivotal Spring framework, spring framework, agile product lifecycle management

Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webf...

CVSS
7.5
EPSS
9.21%
95.0% percentile
CISA KEV
Not listed
Published
2018.10.19
PRIORITY ASSESSMENT

Review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability9.21%
Technical severityCVSS 7.5

Vulnerability overview

Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webf...

Affected product and versions

Product
Pivotal Spring framework, spring framework, agile product lifecycle management
Affected versions
>= 5.1, >= 5.0.0 <= 5.0.9, >= 4.3 <= 4.3.19, >= 4.2.0 < 4.3.20, >= 5.0.0 < 5.0.10, 5.1.0, 9.3.3, 9.3.4, 9.3.5, 9.3.6, 11.3, 12.0, 6.0, 6.1, 8.0.0, 8.1, 8.2, 8.2.1, 8.1.1, 8.2.0
Fixed versions
4.3.20, 5.0.10

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Pivotal Spring framework, spring framework, agile product lifecycle management and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
Not available