Vulnerability Name:

CVE-2018-1199 (CCN-138601)

Assigned:2017-12-06
Published:2018-01-29
Updated:2022-06-23
Summary:Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. In this particular attack, different character encodings used in path parameters allows secured Spring MVC static resource URLs to be bypassed.
CVSS v3 Severity:5.3 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
4.6 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
4.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-20
Vulnerability Consequences:Bypass Security
References:Source: MITRE
Type: CNA
CVE-2018-1199

Source: CCN
Type: JVN#15643848
Spring Security and Spring Framework vulnerable to authentication bypass

Source: REDHAT
Type: Third Party Advisory
RHSA-2018:2405

Source: XF
Type: UNKNOWN
pivotal-cve20181199-sec-bypass(138601)

Source: MLIST
Type: Mailing List, Third Party Advisory
[activemq-issues] 20190703 [jira] [Created] (AMQ-7236) SEV-1 Security vulnerability in spring-expression-4.3.11.RELEASE.jar (spring framework)

Source: MLIST
Type: Mailing List, Third Party Advisory
[activemq-issues] 20190703 [jira] [Updated] (AMQ-7236) SEV-1 Security vulnerability in spring-expression-4.3.11.RELEASE.jar (spring framework) and xstream-1.4.10.jar

Source: MLIST
Type: Mailing List, Third Party Advisory
[activemq-issues] 20190718 [jira] [Updated] (AMQ-7236) SEV-1 Security vulnerability in spring-expression-4.3.11.RELEASE.jar (spring framework) and xstream-1.4.10.jar

Source: CCN
Type: Pivotal Web site
CVE-2018-1199: Security bypass with static resources

Source: CONFIRM
Type: Vendor Advisory
https://pivotal.io/security/cve-2018-1199

Source: CCN
Type: IBM Security Bulletin 6403331 (Security Guardium Data Encryption)
Multiple Vulnerabilities in IBM Guardium Data Encryption (GDE)

Source: CCN
Type: IBM Security Bulletin 6841803 (Cognos Controller)
IBM Cognos Controller has addressed multiple vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6984347 (Engineering Requirements Management DOORS)
IBM Engineering Requirements Management DOORS/DWA vulnerabilities fixes for 9.7.2.6

Source: MISC
Type: Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2018-1199

Vulnerable Configuration:Configuration 1:
  • cpe:/a:vmware:spring_framework:*:*:*:*:*:*:*:* (Version >= 5.0.0 and < 5.0.3)
  • OR cpe:/a:vmware:spring_security:*:*:*:*:*:*:*:* (Version >= 4.1.0 and < 4.1.5)
  • OR cpe:/a:vmware:spring_security:*:*:*:*:*:*:*:* (Version >= 4.2.0 and < 4.2.4)
  • OR cpe:/a:vmware:spring_security:*:*:*:*:*:*:*:* (Version >= 5.0.0 and < 5.0.1)
  • OR cpe:/a:vmware:spring_framework:*:*:*:*:*:*:*:* (Version >= 4.3.0 and < 4.3.14)

    • Configuration 2:
  • cpe:/a:redhat:fuse:1.0:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:rapid_planning:12.1:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:rapid_planning:12.2:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:pivotal:spring_framework:4.3.0:*:*:*:*:*:*:*
  • OR cpe:/a:pivotal:spring_framework:4.3.13:*:*:*:*:*:*:*
  • OR cpe:/a:pivotal:spring_framework:5.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:pivotal:spring_framework:5.0.2:*:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:cognos_controller:10.4.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cognos_controller:10.4.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:security_guardium_data_encryption:3.0.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cognos_controller:10.4.2:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:com.ubuntu.xenial:def:201811990000000
    V
    		CVE-2018-1199 on Ubuntu 16.04 LTS (xenial) - medium.
    2018-03-16
    oval:com.ubuntu.artful:def:20181199000
    V
    		CVE-2018-1199 on Ubuntu 17.10 (artful) - untriaged.
    2018-03-16
    oval:com.ubuntu.xenial:def:20181199000
    V
    		CVE-2018-1199 on Ubuntu 16.04 LTS (xenial) - untriaged.
    2018-03-16
    oval:com.ubuntu.disco:def:201811990000000
    V
    		CVE-2018-1199 on Ubuntu 19.04 (disco) - medium.
    2018-03-16
    oval:com.ubuntu.bionic:def:20181199000
    V
    		CVE-2018-1199 on Ubuntu 18.04 LTS (bionic) - untriaged.
    2018-03-16
    oval:com.ubuntu.cosmic:def:201811990000000
    V
    		CVE-2018-1199 on Ubuntu 18.10 (cosmic) - medium.
    2018-03-16
    oval:com.ubuntu.cosmic:def:20181199000
    V
    		CVE-2018-1199 on Ubuntu 18.10 (cosmic) - untriaged.
    2018-03-16
    oval:com.ubuntu.bionic:def:201811990000000
    V
    		CVE-2018-1199 on Ubuntu 18.04 LTS (bionic) - medium.
    2018-03-16
    oval:com.ubuntu.trusty:def:20181199000
    V
    		CVE-2018-1199 on Ubuntu 14.04 LTS (trusty) - untriaged.
    2018-03-16
    BACK
    vmware spring framework *
    vmware spring security *
    vmware spring security *
    vmware spring security *
    vmware spring framework *
    redhat fuse 1.0
    oracle retail xstore point of service 7.1
    oracle rapid planning 12.1
    oracle rapid planning 12.2
    pivotal spring framework 4.3.0
    pivotal spring framework 4.3.13
    pivotal spring framework 5.0.0
    pivotal spring framework 5.0.2
    ibm cognos controller 10.4.0
    ibm cognos controller 10.4.1
    ibm security guardium data encryption 3.0.0.2
    ibm cognos controller 10.4.2